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Why GAO Did This Study 

The Department of Homeland 
Security (DHS) established the U.S. 
Visitor and Immigrant Status 
Indicator Technology (US-VISIT) 
program to collect, maintain, and 
share data on selected foreign 
nationals entering and exiting the 
United States at air, sea and land 
ports of entry (POEs). These data, 
including biometric identifiers like 
digital fingerprints, are to be used 
to screen persons against watch 
lists, verify visitors' identities, and 
record arrival and departure. GAO 
was asked to review 
implementation at land POE 
facilities and in doing so GAO 
analyzed: (1) efforts to implement 
US-VISIT entry capability; (2) 
efforts to implement US- VISIT exit 
capability; and (3) DHS's efforts to 
define how US-VISIT fits with other 
emerging border security 
initiatives. GAO reviewed DHS and 
US- VISIT program documents, 
interviewed program officials, and 
visited 21 land POEs with varied 
traffic levels on both borders. 



What GAO Recommends 



GAO recommends that DHS 
improve existing management 
controls for US-VISIT; develop 
performance measures to assess 
the impact of US-VISIT at land 
POEs; and ensure that a statutorily 
mandated report describes how 
DHS will move to a biometric 
entry/exit capability and align US- 
VISIT with emerging land border 
security initiatives. DHS generally 
agreed and said that it has begun to 
or plans to implement GAO's 
recommendations. 
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To view the full product, including the scope 
and methodology, click on the link above. 
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What GAO Found 

US- VISIT entry capability has been installed at 154 of the 170 land POEs. 
Officials at all 21 sites GAO visited reported that US- VISIT had improved 
their ability to process visitors and verify identities. DHS plans to further 
enhance US-VISIT's capabilities by, among other things, requiring new 
technology and equipment for scanning all 10 fingerprints (see photo, left, 
below). While this may aid border security, installation could increase 
processing times and adversely affect operations at land POEs where space 
constraints, traffic congestion, and processing delays already exist. GAO's 
work indicated that management controls in place to identify such problems 
and evaluate operations were insufficient and inconsistently administered. 
For example, GAO identified computer processing problems at 12 sites 
visited; at 9 of these, the problems were not always reported. US-VISIT has 
developed performance measures, but measures to gauge factors that 
uniquely affect land POE operations were not developed; these would put 
US- VISIT officials in a better position to identify areas for improvement. 

US- VISIT officials concluded that, for various reasons, a biometric US- VISIT 
exit capability cannot now be implemented without incurring a major impact 
on land POE facilities. An interim nonbiometric exit technology being tested 
(see photo, right, below) does not meet the statutory requirement for a 
biometric exit capability and cannot ensure that visitors who enter the 
country are those who leave. DHS has not yet reported to Congress on a 
required plan describing how it intends to fully implement a biometric 
entry/exit program, or use nonbiometric solutions. Until this plan is finalized, 
neither DHS nor Congress is in a good position to prioritize and allocate 
program resources or plan for POE facilities modifications. 

DHS has not yet articulated how US-VISIT is to align with other emerging 
land border security initiatives and mandates, and thus cannot ensure that 
the program will meet strategic program goals and operate cost effectively at 
land POEs. Knowing how US- VISIT is to work with these initiatives, such as 
one requiring U.S. citizens, Canadians, and others to present passports or 
other documents at the border in 2009, is important for understanding the 
broader strategic context for US-VISIT and identifying resources, tools, and 
potential facility modifications needed to ensure success. 

US-VISIT entry capability set-up with computer and camera (left); nonbiometric exit 
identification readers mounted over highway (right) 
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Washington, DC 20548 



December 6, 2006 
Congressional Requesters 

This report is a publicly available version of our report on the 
implementation of the U.S. Visitor and Immigrant Status Indicator 
Technology (US-VISIT) program at land ports of entry (POE). 1 Our 
original report was designated For Official Use Only because, according to 
the Department of Homeland Security (DHS), it contained specific 
information of a sensitive nature. 

In the years since the 2001 terrorist attacks, the need to secure U.S. 
borders has taken on added importance and has received increasing 
attention from Congress and the public. In an effort to avoid repetition of 
such attacks, and improve overall national security, Congress and the 
Administration have sought better ways to record and track the entry and 
departure of foreign visitors who pass through U.S. POEs by air, land, or 
sea, to verify their identities, and to authenticate their travel 
documentation. In March 2003, responsibility for these efforts was 
transferred from the former Immigration and Naturalization Service to 
DHS. Pursuant to several statutory mandates, DHS, in consultation with 
the Department of State, established an automated visitor system to 
integrate information on the entry and exit from the United States of 
foreign nationals, called the US-VISIT Program. 

According to DHS, the purpose of US- VISIT is to enhance the security of 
U.S. citizens and visitors, facilitate legitimate travel and trade, ensure the 
integrity of the U.S. immigration system, and protect visitors' privacy. The 
program is managed by the US- VISIT Program Office, which is headed by 
the US- VISIT Director, who currently reports to the DHS Deputy Secretary. 
US- VISIT is used in the field by officers with U.S. Customs and Border 
Protection (CBP), a separate DHS component. US-VISIT processing is one 
of many activities that takes place at POEs, where CBP officers enforce 
U.S. immigration laws governing the admissibility of the millions of aliens 
entering and U.S. citizens reentering the country daily; screen cargo for 



1 A port of entry is generally a physical location, such as a pedestrian walkway and/or a 
vehicle plaza with booths, and associated inspection and administration buildings, at a land 
border crossing point, or a restricted area inside an airport or seaport, where entry into the 
country by persons and cargo arriving by air, land, or sea is controlled by U.S. Customs and 
Border Protection (CBP). 
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weapons or illegal or dangerous goods; prevent narcotics, agricultural 
pests, and smuggled goods from entering the country; and identify and 
arrest those with outstanding criminal warrants. 

US- VISIT is designed to use biographic information (e.g., name, 
nationality, and date of birth) and biometric information (e.g., digital 
fingerprint scans and photographs) to verify the identity of those covered 
by the program. The program applies to certain visitors whether they hold 
a nonimmigrant visa or are traveling from a country that has a visa waiver 
agreement with the United States under the Visa Waiver Program. 2 U.S. 
citizens, lawful permanent residents, and most Canadian and Mexican 3 
citizens are currently exempt from being processed under US- VISIT upon 
entering and exiting the country. 4 Foreign nationals subject to US- VISIT 
who intend to enter the country encounter different inspection processes 
at different types of POEs depending on their mode of travel. Foreign 
nationals subject to US-VISIT who intend to enter the United States at an 
air or sea POE are to be processed, for purposes of US- VISIT, in the 
primary inspection area upon arrival. Generally, these visitors are subject 
to prescreening before they arrive via passenger manifests, which are 



2 The Visa Waiver Program enables nationals of certain countries to travel to the United 
States for tourism or business for stays of 90 days or less without obtaining a visa. Most 
western European countries participate in this program, along with Japan, Singapore, 
Australia, Brunei, and New Zealand. Appendix II lists all 27 Visa Waiver Program countries. 

3 To visit the United States, Mexican citizens generally need either a Mexican passport and 
U.S. visa, or a Border Crossing Card (BCC), which is issued to Mexican visitors who wish 
to enter the country for business or pleasure for no more than 6 months. The BCC contains 
machine-readable biographic and biometric information. Mexican citizens with BCCs who 
are traveling within 25 miles of the border, (75 miles in Arizona, if entering through certain 
POEs near Tucson) and who plan to stay no more than 30 days, are generally not subject to 
US-VISIT processing upon entry. A Mexican citizen is subject to US-VISIT requirements, 
however, if a CBP officer determines that the entrant intends to stay more than 30 days or 
travel beyond the 25- or 75-mile limit. 

4 On July 27, 2006 DHS issued a Notice of Proposed Rulemaking that, if finalized, would 
expand the scope of US-VISIT to include, among others, lawful permanent residents, aliens 
seeking admission on immigrant visas, refugees and asylees, and certain categories of 
Canadians. DHS did not report how many additional persons would be covered by US- 
VISIT if the rule were adopted. 
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forwarded to CBP by commercial air or sea carrier in advance of arrival. 5 
By contrast, foreign nationals intending to enter the United States at land 
POEs are generally not subject to prescreening because they arrive in 
private vehicles or on foot and there is no manifest to record their pending 
arrival. Thus, when foreign nationals subject to US- VISIT arrive at a land 
POE, they are directed by CBP officers from the primary inspection area 
to the secondary inspection area for further processing. At all POEs, 
visitors covered by US- VISIT who are determined to be admissible are 
issued an 1-94 arrival/departure form, which, among other things, records 
their date of arrival and the date their authorized period of admission 
expires. The requirement that arriving nonimmigrants admitted to the 
United States, unless otherwise exempted, be issued an 1-94 as evidence of 
the terms of their admission predates implementation of US- VISIT and was 
incorporated into US-VISIT processing. 6 

Many aspects of US-VISIT program implementation have been driven or 
defined by various legislative mandates. These include a 2001 statutory 
requirement to focus particularly on the use of biometric technology in 
developing the integrated entry-exit system subsequently named US- VISIT; 
a 2002 statutory requirement to develop biometric identifier standards to 
be used to verify the identity of persons seeking to enter the United States 
at POEs; and a requirement to install at all POEs equipment and software 
to allow biometric comparison and authentication of U.S. visas and other 
travel and entry documents issued to aliens, as well as Visa Waiver 
Program participant passports. In addition, by law, an integrated entry and 
exit data system was to be implemented at all U.S. POEs, including land 
POEs, by December 31, 2005, but there was no specific requirement to 
collect any new data on foreign nationals departing at land POEs by that 



5 Under the Enhanced Border Security and Visa Entry Reform Act of 2002 (Pub. L. No. 107- 
173, § 402(a), 116 Stat. 543, 557-59), commercial air and sea carriers are to transmit crew 
and passenger manifests to appropriate immigration officials before arrival of an aircraft or 
vessel in the United States. These manifests are transmitted to CBP through the Advanced 
Passenger Information System (APIS), which helps officers identify (1) those arrivals for 
which biometric data are available and (2) foreign nationals who need to be scrutinized 
more closely. 

Visitors traveling on nonimmigrant visas are issued Form 1-94 and visitors from Visa 
Waiver Program countries are issued Form I-94W. Both forms show the date of arrival, port 
of entry, and date the authorized period of admission expires. Whereas passengers arriving 
on commercial air or sea liners are to fill out portions of an 1-94 or I-94W arrival and 
departure form on the carrier in advance of arriving, visitors subject to US-VISIT at land 
POEs are to provide information for I-94s and I-94Ws during the inspection process, and 
the forms are issued after the process is completed. 
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date. The Intelligence Reform and Terrorism Prevention Act of 2004, on 
the other hand, did require the collection of biometric exit data for all 
individuals subject to US-VISIT, but it did not set a deadline for 
implementation of this requirement. 

The United States shares over 7,500 miles of land border with Canada and 
Mexico and currently, CBP operates 170 land POEs on the northern border 
with Canada and the southwest border with Mexico. These POEs are 
diverse in nature, with some operating in urban areas, such as Detroit, 
Michigan, and others operating in remote areas, such as the northern 
plains in Montana or along the southwest border. Taken together, land 
POEs process the largest number of visitors to the United States each year 
among all POEs (about 79 percent of about 425 million total border 
crossings during fiscal year 2004) and process fewer US-VISIT eligible 
visitors as compared to other POEs (about 11 percent of about 42 million 
border crossings processed via US-VISIT during fiscal year 2004). 

As US- VISIT was being installed at land POEs, questions arose about the 
impact the program was having on the existing POE facilities where 
legitimate land-border crossings take place, particularly in light of a goal, 
stated by a former DHS Undersecretary, to develop a "smart border — one 
that speeds through legitimate trade and travel, but stops terrorists in their 
tracks." We were asked to review implementation of US-VISIT at land POE 
facilities. Specifically, we analyzed the following issues: (1) What has the 
US- VISIT Program Office done to implement US- VISIT entry capabilities at 
land POEs and what impact has US-VISIT had on these facilities? (2) What 
is the status of US-VISIT Program Office efforts to implement a US-VISIT 
exit capability at land POE facilities? (3) What has DHS done to define a 
strategic context to show how US- VISIT entry and exit capabilities at land 
POE facilities fit with other current and emerging border security 
initiatives? 

To meet our objectives, we met with officials at CBP and the US- VISIT 
Program Office within DHS in Washington, D.C. We reviewed applicable 
laws and regulations and studies on the US- VISIT program and examined 
available DHS documents on US- VISIT entry and exit capability and 
deployment at land POEs. We also visited 21 selected land POEs on the 
northern and southern borders where US-VISIT entry capability had been 
installed. Along the northern border, we visited land POEs at the Windsor 
Tunnel and Ambassador Bridge in Detroit, Michigan; the Thousand Islands 
Bridge at Alexandria Bay, Champlain, Overton Corners, and Rouses Point 
in northern New York State; Highgate Springs and Alburg Springs in 
northern Vermont; and Blaine-Pacific Highway and Blaine-Peace Arch in 
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Blaine, Washington. Along the southern border, we visited the DeConcini, 
Morley Gate, and Mariposa POEs in Nogales, Arizona; the POE in San 
Ysidro in California; and POEs in Brownsville-Matamoros Bridge, 
Brownsville-Gateway, and Brownsville-Los Tomates/V eterans 
International Bridge, Hidalgo, Progreso, Pharr, and Los Ebanos in Texas. 
We selected these locations to ensure coverage on both borders and to 
obtain a mix of sites with varied types of environments and levels of traffic 
volume. Where feasible, we also chose to visit some geographically 
proximate POEs to minimize travel costs. In addition, five of these POEs 
(Thousand Islands Bridge, Blaine-Peace Arch, Blaine-Pacific Highway, 
DeConcini, and Mariposa) had been designated by DHS as locations to test 
exit technology. At all the locations we visited, we observed how US-VISIT 
equipment was installed and operated and interviewed CBP officials about 
US- VISIT installation and operations following deployment. We also 
observed the impacts of US- VISIT equipment and operations on POE 
facilities and infrastructures. In addition, we examined whether internal 
control mechanisms were in place and being used to ensure that program 
objectives were being achieved, consistent with GAO's Standards for 
Internal Controls in the Federal Government. 7 The information from our 
site visits is limited to the 21 land ports we visited and is not generalizable 
to all land ports of entry. Appendix I discusses our scope and methodology 
in greater detail. 

We conducted our work from September 2005 through October 2006 in 
accordance with generally accepted government auditing standards. 



RGSllltS in Brief DHS has installed the entry portion of US- VISIT at 154 of the nation's 170 

land POEs, 8 usually with minimal new construction or changes to existing 
facilities. As required by law, the US-VISIT entry capability includes 
biometric features — such as digital scans of 2 fingerprints — to help verify 
the identity of visitors. CBP officials at all 21 land POEs we visited told us 
that US-VISIT's entry capability has generally enhanced their ability to 
process visitors subject to US-VISIT by providing assurance that visitors' 



'GAO, Internal Control: Standards for Internal Control in the Federal Government, 
GAO/AIMD-00-2 1.3.1 (Washington, D.C.: November 1999), and GAO, Internal Control 
Standards: Internal Control Management and Evaluation Tool, GAO-01-1008G 
(Washington, D.C.: August 2001). 

8 US-VISIT was not installed at 14 of the 16 other POEs because visitors subject to US-VISIT 
are not permitted to enter the country at those locations; at the other 2 POEs, DHS lacked 
the infrastructure needed to install the equipment. 
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identities can be confirmed through biometric identifiers and by 
automating the paperwork associated with processing 1-94 
arrival/departure forms. Going forward, DHS plans to introduce changes 
and enhancements to US-VISIT at land POEs intended to further bolster 
CBP's ability to verify the identity of individuals entering the country, 
including a transition from digitally scanning 2 fingerprints to 10. While 
such changes are intended to further enhance border security, deploying 
them may have an impact on aging and space-constrained land POE 
facilities because they could increase inspection times and adversely 
affect POE operations. Moreover, our previous and current work showed 
that the US-VISIT program office had not taken necessary steps to help 
ensure that US-VISIT entry capability operates as intended. For example, 
in February 2006 we reported that the approach taken by the US- VISIT 
program office to evaluate the impact of US- VISIT on land POE facilities 
focused on changes in 1-94 processing time at 5 POEs and did not examine 
other operational factors, such as US- VISIT'S impact on physical facilities 
or work force requirements. 9 As a result, program officials did not always 
have the information they needed to anticipate problems that occurred, 
such as problems processing high volumes of visitors in space constrained 
facilities. Turning to another aspect of our evaluation, our standards for 
internal controls in the federal government state that it is important for 
agencies to have controls in place to help ensure that policies and 
procedures are applied and that managers be made aware of problems so 
that that they can be addressed and resolved in a timely fashion. 10 CBP 
officials at 12 of 21 land POE sites we visited told us about US-VISIT- 
related computer slowdowns and freezes which adversely affected visitor 
processing and inspection times and at 9 of the 12 sites, computer 
processing problems were not always reported to CBP's computer help 
desk, as required by CBP guidelines. Although various controls are in 
place to alert US- VISIT and CBP officials to problems as they occur, these 
controls did not alert officials to all problems, given they had been 
unaware of the problems we identified before we brought them to their 
attention. These computer processing problems have the potential to not 
only inconvenience travelers because of the increased time needed to 
complete the inspection process, but to compromise security, particularly 
if CBP officers are unable to perform biometric checks — one of the critical 
reasons US-VISIT was installed at POEs. Our internal control standards 



9 GAO, Homeland Security: Recommendations to Improve Key Border Security Programs 
Need to Be Implemented, GAO-06-296 (Washington, D.C.: February 2006). 

10 GAO/AIMD-00-21.3.1 and GAO-01-1008G. 
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also call for agencies to establish performance measures throughout the 
organization so that actual performance can be compared to expected 
results. While the US- VISIT program office established performance 
measures for fiscal years 2005 and 2006 intended to gauge performance of 
various aspects of US- VISIT at air, sea and land POEs in the aggregate, 
performance measures specifically for land POEs have not been 
developed. It is important to do so, given that there are significant 
operational and facility differences among these different types of POEs. 
Additional performance measures that consider operational and facility 
differences at land POEs would put US-VISIT program officials in a better 
position to identify problems, trends, and areas needing improvements. 

US- VISIT has concluded that, for various reasons, it cannot currently 
implement a biometric US-VISIT exit capability without incurring a major 
impact on land POE facilities. According to officials, implementing a 
biometrically based exit recording system like that used to record those 
entering or re-entering the country is potentially costly (an estimated $3 
billion), would require new infrastructure, and would produce major 
traffic congestion because travelers would have to stop their vehicles 
upon exit to be processed — an option officials consider unacceptable. US- 
VISIT officials stated that they believe technological advances over the 
next 5 to 10 years will enable the biometric verification of persons exiting 
the country without a major impact on facilities. In the interim, the US- 
VISIT program office is testing radio frequency identification (RFID) 
technology as a nonbiometric means of recording visitors as they exit. 
RFID technology can be used to electronically identify and gather 
information contained on a tag — in this case, a unique identifying number 
embedded in a tag on a visitor's arrival/departure form — which an 
electronic reader at the POE is intended to detect. While RFID technology 
has thus far required few facility and infrastructure changes, US-VISIT's 
initial testing and analysis of this technology has identified numerous 
performance and reliability problems, such as the failure of RFID readers 
to detect a majority of travelers' tags during testing. Additional testing is 
planned to address such problems. Nevertheless, the RFID solution does 
not meet the statutory requirement for a biometric exit capability because 
the technology as tested cannot meet a key goal of US-VISIT — ensuring 
that visitors who enter the country are the same ones who leave. 
Specifically, the RFID tag in the visitor's arrival/departure form cannot be 
physically tied to an individual, which means that while a document may 
be detected as leaving the country, the person to whom it was issued at 
time of entry may be somewhere else. By statute, DHS was to have 
reported to Congress by June 2005 on how it intended to fully implement 
an entry/exit program. This plan is to include, among other things, a 
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description of the manner in which the US-VISIT program meets the goals 
of a comprehensive entry and exit screening system — including both 
biometric entry and exit — and how it will fulfill statutory obligations. As of 
October 2006, this plan was still under review in the Office of the 
Secretary, according to US- VISIT officials. Without such a plan, DHS 
cannot articulate how entry/exit concepts fit together — including any 
interim nonbiometric solutions — and neither DHS nor Congress is in a 
good position to prioritize and allocate resources, including funds for any 
facility modifications that might be needed, for a US-VISIT exit capability, 
to plan for the program's future, or to consider trade-offs between traveler 
convenience and security. 

DHS has not yet articulated how US- VISIT is to strategically fit with other 
land-border security initiatives and mandates, and thus cannot ensure that 
these programs work in harmony to meet mission goals and operate cost 
effectively. As we reported 3 years ago, agency programs need to properly 
fit within a common strategic context governing key aspects of program 
operations, such as what functions are to be performed, what facility or 
infrastructure changes will be needed to ensure that they operate in 
harmony and as intended, and what standards govern the use of 
technology. DHS has drafted a strategic plan defining an overall 
immigration and border management strategy, but has not yet approved it, 
and did not provide it to us for review. Meanwhile, new border security 
initiatives or mandates are planned or under way that could potentially 
have an impact on US-VISIT operations and facilities at land POEs. For 
example, no later than June 2009, U.S. citizens and foreign nationals of 
Canada, Bermuda, and Mexico will be required, for the first time, to 
present a passport or other documents deemed sufficient to show identity 
and citizenship when entering the country from within the western 
hemisphere. It is not yet known what types of documents, other than 
passports, may be permitted at land POEs, or whether these documents 
and the equipment required to read them can be aligned with US-VISIT 
technologies. Until decisions for this and other initiatives are made, it 
remains unclear how this program will be integrated with US- VISIT, if at 
all — raising the possibility that CBP would be faced with managing 
differing technology platforms and border inspection processes at each 
land POE. Knowing how US-VISIT is to work in concert with other border 
security and homeland security initiatives and what facility or facility 
modifications might be needed could help Congress, DHS, and others 
better understand what resources and tools are needed to ensure success 
and ensure that land POE facilities are positioned to accommodate them. 
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To help DHS optimize its investment in US- VISIT at land POEs, we are 
recommending that the Secretary of Homeland Security direct the US- 
VISIT Program Director, in collaboration with the Commissioner of CBP, 
to (1) improve existing controls for identifying and reporting computer 
processing and other operational problems to help ensure that these 
controls are consistently administered and (2) develop performance 
measures specifically for assessing the impact of US- VISIT operations at 
land POEs. Also, in view of the fact that DHS has not met the statutory 
requirement that it issue a report describing a comprehensive biometric 
entry and exit system for US-VISIT, we are also recommending that as 
DHS finalizes the mandated report, the Secretary of Homeland Security 
take steps to ensure that the report includes, among other things, 
information on the costs, benefits, and feasibility of deploying biometric 
and nonbiometric exit capabilities at land POEs; a discussion of how DHS 
intends to move from a nonbiometric exit capability, such as the 
technology currently being tested, to a reliable biometric exit capability 
that meets statutory requirements; and a description of how DHS plans to 
align US- VISIT with other emerging land border security initiatives and 
what facilities or facility modifications would be needed at land POEs to 
ensure that different technologies and processes work in harmony. 

DHS generally agreed with our recommendations and stated that it either 
had begun to take or is planning to take actions to implement them. It 
acknowledged that the exit technology tested by DHS would not satisfy 
statutory requirements for a biometric exit system and said that it would 
perform research and industry outreach to satisfy the mandate. DHS, 
however, disagreed with our finding that the US- VISIT program office did 
not fully consider the impact of US-VISIT on the overall operations at 
POEs. It said that US-VISIT impacts are limited to changes in Form 1-94 
processing time, which according to officials improved, and that issues 
related to capacity, staffing, and other factors are "arguably" beyond the 
scope of US-VISIT. We agree that the approach taken to do operational 
assessments of the impact of US-VISIT land POE facilities focused on 
changes to 1-94 processing time. Our concern is that the assessments did 
not examine other operational factors, such as US- VISIT'S impact on 
physical facilities, to help ensure that US-VISIT operates as intended. We 
believe more complete assessments of the impact of US- VISIT on land 
POE operations would better position DHS to anticipate potential 
problems and develop solutions, especially as additional US- VISIT 
capabilities, such as 10 fingerprint scanning, are introduced at these 
facilities. 
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US- VISIT is a large, complex governmentwide program intended to 
achieve the goals of (1) enhancing the security of U.S. citizens and visitors, 
(2) facilitating legitimate travel and trade, (3) ensuring the integrity of the 
U.S. immigration system, and (4) protecting the privacy of visitors. The 
program is intended to carry out these goals by 

• collecting, maintaining, and sharing information on certain foreign 
nationals who enter and exit the United States; 

• identifying foreign nationals who (1) have overstayed or violated the 
terms of their visit; (2) can receive, extend, or adjust their immigration 
status; or (3) should be apprehended or detained by law enforcement 
officials; 

• detecting fraudulent travel documents, verifying visitor identity, and 
determining visitor admissibility through the use of biometrics (digital 
fingerprints and a digital photograph); and 

• facilitating information sharing and coordination within the 
immigration and border management community. 

Currently, US- VISIT'S scope includes the pre-entry, entry, status, and exit 
of hundreds of millions of foreign national travelers who enter and leave 
the United States at over 300 air, sea, and land POEs. 



Legislative Overview The current statutory framework for US- VISIT originates with a 

requirement to implement an integrated entry and exit data system for 
foreign nationals, enacted in the Immigration and Naturalization Service 
Data Management Improvement Act (DMIA) of 2000. 11 The DMIA replaced 
in its entirety a provision of the Illegal Immigration Reform and Immigrant 
Responsibility Act of 1996 (IIRIRA) that had required an automated system 
to record and then match the departure of every foreign national from the 
United States to the individual's arrival record. 12 The DMIA instead 
required an electronic system that would provide access to and integrate 
foreign national arrival and departure data that are authorized or required 
to be created or collected under law and are in an electronic format in 
certain databases, such as those used at POEs and consular offices. Unlike 
the earlier law, the DMIA specifically provided that it not be interpreted to 
impose any new documentary or data collection requirements on any 
person, but it also provided that it not be construed to reduce or curtail 



l 8 U.S.C. § 1365a. 

! Pub. L. No. 104-208, div. C, § 110, 110 Stat. 3009-546, 3009-558-59. 



Background 
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the authority of DHS or State under any other provision of law. Thus, the 
DMIA did not specifically require the collection of any new data on foreign 
nationals departing at land POEs. 

The system as described in the DMIA is to compare available arrival 
records to available departure records; allow on-line search procedures to 
identify foreign nationals who may have overstayed their authorized 
period of admission; and use available data to produce a report of arriving 
and departing foreign nationals. The DMIA also required the 
implementation of the system at airports and seaports by December 31, 
2003, at the 50 highest volume land POEs by December 31, 2004; and at all 
remaining POEs by December 31, 2005. 

Laws passed after the DMIA also provided specific requirements with 
regard to the use of biometrics for those entering and leaving the country. 
For example, the USA PATRIOT Act required, by October 26, 2003, the 
development and certification of a technology standard, including 
appropriate biometric identifier standards, that can be used to verify the 
identity of persons applying for a U.S. visa, or seeking to enter the United 
States pursuant to a visa, for the purposes of conducting background 
checks, confirming identity, and ensuring that a person has not received a 
visa under a different name. 13 The act also provided that in developing US- 
VISIT, DHS and State were to focus particularly on the utilization of 
biometric technology and the development of tamper-resistant documents 
readable at POEs. The Enhanced Border Security and Visa Entry Reform 
Act of 2002 required DHS and State to implement, fund, and use the 
technology standard, including biometric identifier standards, developed 
under the USA PATRIOT Act at U.S. POEs; it also required the installation 
at all POEs of equipment and software to allow biometric comparison and 
authentication of all U.S. visas and other travel and entry documents 
issued to aliens, and passports issued by Visa Waiver Program 
participating countries with biometric identifiers. The Intelligence Reform 
and Terrorism Prevention Act of 2004, 14 unlike the DMIA, specifically 
required the collection of biometric exit data for all categories of 
individuals required to provide biometric entry data under US- VISIT, 
regardless of the port of entry where they entered the United States. The 



"8 U.S.C. § 1379. The official title of the USA PATRIOT Act is the Uniting and 
Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct 
Terrorism Act of 2001. 

14 Pub. L. No. 108-458. 
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2004 law did not set a deadline for implementation of this requirement, 
however. Appendix III discusses the legislative history of the US- VISIT 
program in greater detail. 



Management and Within DHS, the US-VISIT Program Office is headed by the US-VISIT 

Implementation of US- Director, who reports directly to the Deputy Secretary for Homeland 

yjgjrp Security. The US- VISIT Program Office has responsibility for managing the 

acquisition, deployment, operation, and sustainment of US-VISIT and has 
been delivering US- VISIT capability incrementally. According to US- VISIT, 
increments 1 and 2 include a mix of interim or temporary solutions and 
permanent deployments. For example, increment IB, dealing with exit 
capability at airports, is still being piloted, while US- VISIT entry capability 
at the 50 busiest land POEs — increment 2B — is considered to be a 
permanent deployment. Increment 3 — providing entry capability at the 
land POEs not covered under Increment 2B — is considered by US- VISIT to 
be a permanent deployment and increment 4 is, according to US-VISIT, the 
yet-to-be defined US-VISIT strategic capability. Table 1 summarizes the 
scope, timeline, and intended functionality of the US- VISIT increment 
schedule. This report focuses generally, but not exclusively, on increments 
2B (entry capability at the 50 busiest land POEs), 2C (exit capability at the 
50 busiest land POEs), and 3 (entry capability at the remaining land 
POEs) — the increments and information that are shown in bold in table 1. 
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Table 1: Summary of the Scope, Schedule for Completion, and Intended Functionality of the US-VISIT Increment Schedule 



Increment 




Scope 


Qnhorl 1 1 1 fnr 

ou[icuuic lor 
completion 


Intended functionality 


1 


A 


Entry at air and sea ports of 
entry 


Jan. 5, 2004 a 


Deliver the initial operational biometric entry capability to 
115 air and 14 sea ports. 




B 


Exit at air and sea ports of entry 


Nov. 30, 2004 


Evaluate exit pilot alternatives at 13 air and 2 seaports. 


2 


A 


Read visas and other travel 
documents embedded with 
biometric information upon entry 
at all ports of entry 


Oct. 26, 2006 


Deliver the initial operating capability to compare and 
verify biometric data embedded in machine-readable 
visas and other travel documents at all ports of entry. 




B 


Entry at 50 busiest land ports 
of entry 


Dec. 31,2004" 


Provide biometric entry capability at the 50 busiest 
land ports of entry, including an automated process 
for issuing the 1-94 entry and exit form. 




C 


Exit and reentry at land ports 
of entry 


Jul. 2005-undefined 


Automate recording of exit and reentry at busiest 50 
land ports of entry. 


3 




Remaining land ports of entry 


Dec. 31,2005" 


Provide increment 2B entry capability at remaining 
land ports. 


4 




Undefined 


Undefined 


Define, design, build, and implement a strategic US- 
VISIT capability. 



Source: US-VISIT Program Office. 



Note: Bold text reflects increments primarily focused on land POEs. 

"The statutory deadline for implementing US-VISIT at air and sea ports of entry was December 31 , 
2003; the Federal Register notice announcing implementation of increment 1A by that date was 
published on January 5, 2004. 

"Denotes a statutory deadline. 

According to US-VISIT program officials, increment 4 will likely consist of a further series of 
enhancements. 



From fiscal year 2003 through fiscal year 2007, total funding for the US- 
VISIT program has been about $1.7 billion. Table 2 summarizes 
appropriations for US- VISIT for fiscal years 2003 through 2007, as enacted. 



Table 2: US-VISIT Appropriations Enacted, Fiscal Years 2003 Through 2007 (in millions of dollars) 



2003 2004 2005 2006 2007 

Budget activity appropriated appropriated appropriated appropriated appropriated 

US-VISIT $362 $328 $340 $337 $362 



Source: US-VISIT Program Office. 

Note: Starting in Fiscal Year 2004, funding for the US-VISIT program has been appropriated on a "no- 
year" basis, meaning that there is no time limit on the spending of appropriated funds; funds that 
remain unexpended at the end of a fiscal year are carried over into the next fiscal year. 
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In prior reports on US- VISIT, we have identified numerous challenges that 
DHS faces in delivering program capabilities and benefits on time and 
within budget. In September 2003, we reported that the US- VISIT program 
is a risky endeavor, both because of the type of program it is (large, 
complex, and potentially costly) and because of the way that it was being 
managed. 15 We reported, for example, that the program's acquisition 
management process had not been established, and that US- VISIT lacked a 
governance structure. In March 2004, we testified that DHS faces a major 
challenge maintaining border security while still welcoming visitors. 
Preventing the entry of persons who pose a threat to the United States 
cannot be guaranteed, and the missed entry of just one can have severe 
consequences. Also, US- VISIT is to achieve the important law enforcement 
goal of identifying those who overstay or otherwise violate the terms of 
their visas. Complicating the achievement of these security and law 
enforcement goals are other key US- VISIT goals: facilitating trade and 
travel through POEs and providing for enforcement of U.S. privacy laws 
and regulations. 16 Subsequently, in May 2004, we reported that DHS had 
not employed the kind of rigorous and disciplined management controls 
typically associated with successful programs. 17 Moreover, in February 
2006, we reported that while DHS had taken steps to implement most of 
the recommendations from our 2003 and 2004 reports, progress in critical 
areas had been slow. 18 Of 18 recommendations we made since 2003, only 2 
had been fully implemented, 11 had been partially implemented, and 5 
were in the process of being implemented, although the extent to which 
they would be fully carried out was not yet known. 



US-VISIT Scope, 
Operations, and 
Processing at Land POEs 



As mentioned earlier, US-VISIT currently applies to a certain group of 
foreign nationals — non-immigrants from countries whose residents are 
required to obtain nonimmigrant visas before entering the United States 
and residents of certain countries who are exempt from U.S. visa 
requirements when they apply for admission to the United States for up to 



15 GAO, Homeland Security: Risks Facing Key Border and Transportation Security 
Program Need to Be Addressed, GAO-03-1083 (Washington, D.C.: September 2003). 

16 GAO, Homeland Security: Risks Facing Key Border and Transportation Security 
Program Need to Be Addressed, GAO-04-569T (Washington, D.C.: March 2004). 

17 GAO, Homeland Security: First Phase of Visitor and Immigration Status Program 
Operating, but Improvements Needed, GAO-04-586 (Washington, D.C.: May 2004). 

18 GAO-06-296. 
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90 days for tourism or business purposes under the Visa Waiver Program. 19 
US- VISIT also applies to (1) Mexican nonimmigrants traveling with a 
Border Crossing Card (BCC) who wish to remain in the United States 
longer than 30 days or who declare that they intend to travel more than 25 
miles into the country from the border (or more than 75 miles from the 
Arizona border in the Tucson area) 20 and (2) Canadians traveling to the 
United States for certain specialized reasons. 21 

Most land border crossers — including U.S. citizens, lawful permanent 
residents, and most Canadian and Mexican citizens — are, by regulation or 
statute, not required to enroll into US-VISIT. 22 In fiscal year 2004, for 
example, U.S. citizens and lawful permanent residents comprised about 57 
percent of land border crossers; Canadian and Mexican citizens comprised 



19 Certain holders of nonimmigrant visas, such as foreign diplomats and other 
representatives of foreign governments, and representatives of certain international 
organizations, are expressly exempted from US-VISIT requirements by regulation, as are 
individuals who are younger than 14 or older than 79 on the date of admission. 8 C.F.R. § 
235.1(d)(l)(iv)(A), (B). 

20 Under 8 C.F.R. § 235.1(d)(l)(iv)(C), DHS and the State Department may jointly exempt a 
class of aliens from US- VISIT requirements. On August 31, 2004, DHS announced in the 
Federal Register that the two agencies had determined that US-VISIT requirements 
generally would apply only to Mexican nationals for whom a Form 1-94 is issued under 8 
C.F.R. § 235.1(f)(l)(iii) or (v). This means that Mexican nationals using a BCC who are 
admitted for no more than 30 days to visit within 25 miles of the border (or to visit within 
75 miles of the Arizona border, if entering through certain POEs in Arizona) generally are 
not subject to US-VISIT requirements. 69 Fed. Reg. 53,318, 53,323 (2004). The CBP officer 
determines the intent of an applicant for admission through the inspection process at a 
port of entry, in which the applicant must establish that he or she is entitled to enter the 
United States under all applicable laws and regulations. 8 C.F.R. § 235.1(d)(1). If a Mexican 
BCC holder is admitted to the United States without an 1-94, the terms of that individual's 
admission to the country are the 30 day/25 mile or 75 mile limits, and violation of those 
terms makes the individual removable from the country and possibly inadmissible in the 
future. 8 U.S.C. §§ 1227(a)(1), 1182(a)(6), (9). 

21 These special cases include Canadians who are engaged to American citizens, and 
Canadians who are traveling for the purpose of making major financial investments in the 
United States. 

22 Since the statute governing US-VISIT applies to foreign national arrival and departure 
data only, U.S. citizens do not fall within the scope of the program and therefore are 
exempt from US-VISIT screening. Also, in general, regardless of whether they are to be 
processed into US-VISIT, Mexican citizens must present either a passport and visa or a 
BCC when seeking admission to the United States, while Canadian citizens generally do not 
need such documents. According to US-VISIT, when Mexicans receive a BCC, the data on 
the individual entered into U.S. databases at the time of their visa application are 
accessible by US-VISIT — if they are to be processed into it for any reason. 
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about 41 percent; and less than 2 percent were US-VISIT enrollees. 
Figure 1 shows the number and percent of persons processed under US- 
VISIT as a percentage of all border crossings at land, air, and sea POEs in 
fiscal year 2004. 



Figure 1 : Persons Processed under US-VISIT as a Percentage of all Border Crossings at Land, Air, and Sea Ports of Entry, 
Fiscal Year 2004 



Land ports of entry 



Air ports of entry 



Sea ports of entry 




1.4% 




42.2% 



38.8% 




Total entering United States: 
14.7 million 



Total entering United States: 
75.1 million 



Total entering United States: 
335.3 million 



| | Processed by US-VISIT 

| | Not processed by US-VISIT 

Source: GAO analysts of DHS data. 

Note: Persons processed by US-VISIT may include foreign nationals who were also issued an I-94 
valid for multiple entries and who have re-entered multiple times. Total entering the U.S. includes 
U.S. citizens who may have re-entered the country multiple times and foreign nationals, including 
those not issued l-94s, such as Canadian citizens and Mexicans with BCCs, and those issued 
multiple entry l-94s who also may have re-entered multiple times. U.S. citizens do not fall within the 
statutory scope of US-VISIT and therefore are exempt from US-VISIT screening. 



Foreign nationals covered by US-VISIT enter the United States via a multi- 
step process. For individuals required to obtain visas before entering the 
United States, the US-VISIT process begins overseas at U.S. consular 
offices, which in addition to other processes, collect biographic data 
(i.e., country of origin and date of birth) and biometric data (i.e., digital 
fingerscans and a digital photograph) from the applicant. These data are 
checked against databases or watch lists of known criminals and 
suspected terrorists. If the individual's name does not appear on any watch 
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list and the individual is not disqualified on the basis of other issues that 
may be relevant, he or she is to be issued a visa and may seek admission to 
the United States at a POE. 

When visitors in vehicles first arrive at a land POE, they initially enter the 
primary inspection area where CBP officers, often located in booths, are 
to visually inspect travel documents and query the visitors about such 
matters as their place of birth and proposed destination. Visitors arriving 
as pedestrians enter an equivalent primary inspection area, generally 
inside a CBP building. If the CBP officer believes a more detailed 
inspection is needed or if the visitors are required to be processed under 
US- VISIT for the first time, 23 the visitors are to be referred to the secondary 
inspection area — an area away from the primary inspection area — which is 
generally inside a facility. The secondary inspection area inside the facility 
generally contains office space, waiting areas, and space to process 
visitors, including US- VISIT enrollees. Equipment used for US- VISIT 
processing includes a computer, printer, digital camera, and a two- 
fingerprint scanner. Figure 2 shows US-VISIT equipment installed at one 
land POE. 



At land border POEs, the 1-94 issued to foreign nationals covered by US-VISIT who are 
deemed admissible is considered issued for multiple entries, unless specifically annotated 
otherwise. A multiple entry 1-94 permits them to reenter the country, generally for up to 6 
months, without additional US-VISIT processing during the period covered by the 1-94. 
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Figure 2: US-VISIT Equipment (computer, camera, and printer) at a Land POE 
Secondary Inspection Area 




Source: US-VISIT Program Office. 



CBP officers use a document reader to scan machine readable travel 
documents, such as a passport or visa, and use computers to check 
biographic data from the documents against watch list databases. For US- 
VISIT processing, biometric verification is performed in part by taking a 
digital scan of visitors' fingerprints (the left and right index fingers) and by 
taking a digital photograph of the visitor. These data are stored in the 
system's databases. The computer system compares the two index 
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fingerprints to those stored in DHS's Automated Biometric Identification 
System (IDENT) that, among other things, collects and stores biometric 
data about foreign nationals, including FBI information on all known and 
suspected terrorists. 

If the fingerprints are already in IDENT, the system performs a match 
against the existing digital scans to confirm that the person submitting the 
fingerprints at secondary inspection at the POE is the one on file. In 
addition, the CBP officer visually compares the person to the photograph 
that is in the database, which is brought up onto the computer screen. If 
no prints are found in IDENT (for example, if the visitor is from a visa- 
waiver country), that person is then processed into US-VISIT, with 
biographic data entered into the databases, a digital scan of his or her two 
index fingerprints, and a digital photograph. Once the CBP officer deems 
the visitor to be admissible, the individual is issued an 1-94 or an I-94W (for 
persons from visa waiver countries) arrival/departure form. Figure 3 
shows how U.S. citizens and most Mexicans, Canadians, and foreign 
nationals subject to US-VISIT are to be processed at land POEs. 
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Figure 3: Overview of US-VISIT Enrollment at Land POEs for Visitors with and without Visas Entering the Country for the First 
Time 
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— ► 
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Sources: GAO (analysis), MapArt (map). 

Note: Most Mexican entrants with BCCs are not required to obtain an 1-94 arrival/departure form if 
CBP officers determine that the entrants do not intend to travel more than 25 miles into the country or 
stay more than 30 days. If it is determined by the CBP officer that a Mexican citizen intends to exceed 
either limit, the entrant is referred to secondary inspection at the POE, where they are to be 
processed into US-VISIT, and issued an 1-94 form, if no grounds are found on which to deny them 
entry. According to federal regulation (8 CFR § 235.1 (f)(1)(v)(A)), in the Tucson sector, Mexican 
visitors may travel up to 75 miles into the country without being issued an I-94 form, which means that 
they generally would not be processed into US-VISIT upon entry. 
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In addition to IDENT, US- VISIT relies on a number of information systems 
to process visitors. Among the computer software applications utilized as 
part of US- VISIT is U.S. Arrival, which provides an integrated process for 
issuing 1-94 forms and collection of biometric data for visitors covered by 
US- VISIT who arrive at land POEs. Another is U.S. Pedestrian, which is 
used by CBP officers in conducting inspections of visitors who arrive at 
land POEs, entering the United States on foot, mostly along the southern 
border. 



Overview of Land POE As of August 2006, there were 170 land POEs that are geographically 

Facilities dispersed along the nation's more than 7,500 miles of borders with Canada 

and Mexico. Some are located in rural areas (such as Alexandria Bay, New 
York and Blaine-Pacific Highway, Washington) and others in cities (such 
as Detroit) or in U.S. cities across from Mexican cities, such as Laredo and 
El Paso, Texas. The volume of visitor traffic at these POEs varies widely, 
with the busiest four POEs characterized by CBP as San Ysidro, Calexico, 
and Otay Mesa, California, and Bridge of the Americas in El Paso, Texas. 
Appendix IV lists the 20 busiest land POEs, based on the number of 
individuals in vehicles and pedestrian traffic recorded entering the country 
through POEs in fiscal year 2005. 

From a facilities standpoint, land POEs vary substantially in building type 
and size (square footage) as shown in Figures 4a, 4b, and 4c. 



Figure 4a: Land POE at Blaine-Peace Arch in Blaine, Washington 




Source: US-VISIT Program Office. 
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Figure 4b: Land POE Facility at the Detroit-Windsor Tunnel in Detroit, Michigan 




Source: GAO. 
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Figure 4c: Land POE Facility at Rouses Point, New York 




Source: GAO. 



DHS Has Installed US- 
VISIT Biometric Entry 
Capability at Nearly 
All Land POEs, but 
Faces Challenges 
Identifying and 
Monitoring the 
Operational Impacts 
on POE Facilities 



DHS has installed US-VISIT biometric entry capability at nearly all land 
POEs consistent with statutory deadlines, but faces challenges identifying 
and monitoring the operational impacts on POE facilities. CBP officials at 
the 21 land POEs we visited told us that US- VISIT has generally enhanced 
the officials' ability to process visitors subject to US- VISIT by providing 
officials the ability to do biometric checks and automating the issuance of 
the visitor 1-94 arrival/departure form. DHS plans to introduce changes and 
enhancements to US- VISIT at land POEs intended to bolster border 
security, but deploying them poses potential operational challenges to 
land POE facilities that are known by DHS to be space-constrained. US- 
VISIT's efforts to evaluate the impact of US-VISIT on land POE facilities 
thus far raises questions about whether sufficient management controls 
exist to ensure that additional operational impacts, such as processing 
delays or further space constraints, will be anticipated, identified, and 
appropriately addressed and resolved. 
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US-VISIT Biometric Entry 
Capability Was Installed at 
Nearly All Land POEs with 
Minimal Construction, 
According to Program 
Officials 



In December 2005, DHS officials announced that US-VISIT biometric entry 
capability had been installed at land POEs in conformance with statutory 
mandates and Increments 2B and 3 of DHS's US- VISIT schedule. 
Deployment at the 50 busiest land POEs was completed by December 31, 
2004, and at all but 2 of the other land POEs where DHS determined the 
program should operate by December 31, 2005, as required by law. Our 
review of US-VISIT records and discussions with US-VISIT program 
officials indicated that DHS installed US-VISIT biometric entry capability 
at 154 of 170 land POEs. (App. V lists all land POEs where US-VISIT has 
been installed.) With regard to 14 of the 16 POEs where US-VISIT was not 
installed, CBP and US-VISIT program office officials told us there was no 
operational need for US- VISIT because visitors who are required to be 
processed into US-VISIT are, by regulation, not authorized to enter the 
United States at these locations. 24 Generally, these POEs are small facilities 
in remote areas. At 2 other POEs, US-VISIT needs to be installed in order 
to achieve full implementation as required by law, but both of these 
present significant challenges to installation of US-VISIT. These POEs do 
not currently have access to appropriate communication transmission 
lines to operate US- VISIT. CBP officials told us that, given this constraint, 
they determined that they could continue to operate as before. Thus, CBP 
officers at these locations process foreign visitors manually. 

US- VISIT program officials reported and available records showed that 
equipment for US-VISIT entry capability was installed with minimal 
construction at the 154 land POEs. At the 21 land POEs we visited, we 
observed that US- VISIT entry capability equipment had been installed with 
little or no change to facilities. For example, at the Detroit- Windsor tunnel 
and the Detroit Ambassador Bridge POEs in Detroit, Michigan, officials 
confirmed that no additional computer workstations were required to be 
installed; at the Blaine-Peace Arch POE at Blaine, Washington, electrical 
capacity was upgraded to accommodate US-VISIT computer needs. In 
general, our review of reports prepared for each of these POEs indicated 
that DHS upgraded existing or added new computer workstations and 
printers in the secondary inspections areas of these facilities (the area 
where US- VISIT enrollees are processed); installed digital cameras to 
photograph those to be processed in US- VISIT; installed two-fingerprint 



According to CBP, these ports are classified as Class B ports. Under 8 C.F.R. § 100.4(c)(2), 
only citizens of the United States, Canada, and Bermuda, and Lawful Permanent Residents 
of the United States and certain holders of border crossing cards may enter through Class 
B ports. Other foreign nationals are allowed to enter the United States only at Class A 
ports. 
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scanners that digitally record fingerprints; and installed electronic card 
readers for detecting data embedded in machine-readable passports and 
visas. According to US-VISIT officials, funding for installing US-VISIT entry 
equipment nationwide was approximately $16 million — about 9 percent of 
the $182 million budgeted for US- VISIT deployment at land ports between 
fiscal year 2003 and fiscal year 2005. Officials reported that the remaining 
funds were allocated to computer network infrastructure (about 72 
percent) and design and development, network engineering, fingerscan 
devices, and public awareness and outreach (about 19 percent). 26 

During our site visits, CBP officials at all 21 facilities told us that having 
US- VISIT biometric entry capability generally improved their ability to 
process visitors required to enroll in US- VISIT because it provided them 
additional assurance that visitors are who they say they are and automated 
the paperwork associated with processing the 1-94 arrival/departure form. 
For example, with US- VISIT, the ability to scan a visitor's passport or other 
travel document enables the computer at the inspection site to capture 
basic biographic information and automatically print it on the 1-94 form; 
prior to US- VISIT deployment, the 1-94 was filled in manually by the CBP 
officer or the visitor. 



Steps Have Been Taken to 
Address Operational 
Challenges Identified at 
Land POEs, but DHS May 
Face Additional 
Challenges Resulting from 
Planned Enhancements 



DHS plans to introduce changes and enhancements to US- VISIT at land 
POEs that are designed to further bolster CBP's ability to verify that 
individuals attempting to enter the country are who they say they are. 
While these changes may further aid border security, deploying them 
poses potential challenges to land POE facilities where US- VISIT operates 
and where millions of visitors are processed annually. Our site visits, 
interviews with US-VISIT and CBP officials, and the work of others 
suggest that both before and after US- VISIT entry capability was installed 
at land POEs, these facilities faced a number of challenges — operational 
and physical — including space constraints complicated by the logistics of 
processing high volumes of visitors and associated traffic congestion. 



With respect to operational challenges at land POE facilities, we reported 
in November 2002 — more than 2 years before US-VISIT entry capability 
was installed at the 50 busiest land POEs — that busy land POEs were 
experiencing 2- to 3-hour delays in processing visitors and that any 



2j According to US-VISIT officials, as of March 2006 about $179.5 million of the total $182 
million budget had been obligated. 
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lengthening of the entry process could affect visitors significantly, through 
additional wait times. 26 While we cannot generalize about the impact US- 
VISIT has had on processing time at all land POEs, at one of the busiest 
land POEs we visited — San Ysidro, California, where more than 41 million 
visitors entering the country in 2005 were processed — CBP officials told us 
that, although they had not measured differences in processing times 
before and after US- VISIT was installed, the steps required to process US- 
VISIT visitors had added to the total time needed to process all visitors 
entering through the port. As a result, CBP officials told us that they must 
occasionally direct visitors arriving at peak times, such as holidays, to 
leave and return later in the day because there was no room for them to 
wait. In this case, US- VISIT had an effect on both visitor processing times 
and on the capacity of the facility to physically accommodate pedestrian 
and vehicular traffic. 27 

A similar type of operational problem that reflects how complex visitor 
processing activities occur at facilities was reported by a contractor 
retained by DHS to study wait times associated with the 1-94 issuance 
process at another busy POE, Nogales-DeConcini in Arizona. 28 The study, 
which examined wait times for 3 separate time periods over a 3-month 
period in the summer of 2005, found that wait times varied by day (ranging 
from about 3% minutes to almost 7 minutes across the time periods 
studied) and was more a function of the number of people waiting for an I- 



GAO, Technology Assessment: Using Biometrics for Border Security, GAO-03-174 
(Washington, D.C.: Nov. 15, 2002). 

"According to US-VISIT Pro gram Office officials, prior to deployment of US-VISIT entry 
capability, San Ysidro had its own system that was specifically designed for the POE to 
minimize manual 1-94 processing and help officers speed up the 1-94 issuance process. 
However, according to these officials, although San Ysidro's system was "probably" faster 
than US-VISIT, it did not meet current US- VISIT standards for data protection, integration, 
and privacy and did not require officers to do the same database checks that are part of US- 
VISIT. The officials noted that US-VISIT enhances security because it is designed to access 
multiple databases nationwide and brings uniformity to the 1-94 issuance process across 
POEs. 

28 Center for Transportation Research, the University of Texas at Austin, Assessing the 
Effects of US-VISIT RFID Technology Implementation on Vehicle and Pedestrian 
Crossing Times at DeConcini, Nogales, Ariz. Report No. 2 Pilot Data Collection and 
Analysis to Baseline Data (Austin, Tex., November 2005). The project was performed 
under contract for the DHS Private Sector Office. The report examines processing times at 
primary inspection for privately owned vehicles (POV) and pedestrians and also processing 
times for visitors who require enrollment in US-VISIT with a focus on the introduction of 
Radio Frequency Identification (RFID) technology at the POE, which is discussed later in 
this report. 
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94 rather than the time needed to process each individual under US- 
VISIT. 29 The contractor noted that the group size, wait time, and processing 
all affected the dynamics of the secondary-processing area or room, which 
measured approximately 40 feet by 50 feet. During one day of the study, 
the contractor noted that the secondary processing room became 
crowded, straining processing capacity. The contractor stated that this 
occurred because some of the individuals waiting to obtain I-94s were 
students or seasonal workers that required checks that included phone 
calls to verify their visa status. 30 The contractor concluded that US- VISIT 
provided an advantage over manual 1-94 processing because the 
processing was ultimately more efficient. Nevertheless, the extent to 
which these problems occur is unknown because US-VISIT has not 
performed comparable studies at other locations. 

DHS has long been aware of space constraints and other capacity issues at 
land POE facilities. A task force report developed in response to the 
Immigration and Naturalization Service Data Management Improvement 
Act of 2000 found that 117 of 166 land POEs operating at that time (about 
70 percent) had three-fourths or less of the required space. 31 The US-VISIT 
Program Office subsequently confirmed that land POEs had traffic flow 
problems (i.e., lack of space, insufficient roadways, and poor access to 
facilities) and that many were aging and undersized; the majority of land 
POEs were constructed before 1970 when the volume of border crossings 
was not as great as it is now. Our work for this report indicates that such 
problems persist, though we cannot generalize to all facilities. For 
example, at the Nogales-Morley Gate POE in Arizona, where up to 6,000 
visitors are processed daily (and up to 10,000 on holidays), US- VISIT 
equipment was installed, but the system is not used there because CBP 
determined that it could not accommodate US- VISIT visitors because of 
concerns about CBP's ability to carry out the process in a constrained 
space while thousands of other people not subject to US- VISIT processing 



The average wait times were reported by the US-VISIT contractor for the periods of June 
20 through 25, 2005, and August 15 through 20, 2005. No results were reported for the third 
period from July 7 through 8, 2005. 

30 According to CBP, CBP officers determine what checks are needed to determine 
admissibility depending on the purpose of travel. 

31 DMIA Task Force, DMIA Task Force First Annual Report to Congress, Dec. 2002. 
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already transit through the facility daily. 32 Thus, if a visitor is to be 
processed into US-VISIT from Morley Gate, that person is directed to 
return to Mexico (a few feet away) and to walk the approximately 100 
yards to the Nogales-DeConcini POE facility, which has the capability to 
handle secondary inspections of this kind. Figure 5 shows the Nogales- 
Morley Gate POE building — the small windowed structure on the right is 
the processing site. 



Figure 5: Nogales-Morley Gate POE, Arizona 




Source: US-VISIT Program Office. 



CBP officials at three other land POEs on the southwest border also told 
us that space constraints were a factor in their ability to efficiently process 
those subject to US-VISIT. Specifically, at the POEs at Los Tomates, 
Gateway, and Brownsville/Matamoros, Texas, CBP officials told us that 



CBP based this decision on the high volume of pedestrians entering the United States 
through the Morley Gate POE; the fact that, before deployment, I-94s had not been 
previously issued at the Morley Gate POE; and the close proximity of the Morley Gate POE 
facility to the nearby DeConcini POE facility, about 100 yards away. 
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US- VISIT had made 1-94 processing more efficient, but travelers continued 
to experience delays of up to 2 hours on peak holiday weekends as they 
had before US- VISIT was installed. Officials at these facilities told us that 
they believe they could alleviate this problem if the facility had the space 
to install more workstations capable of operating US- VISIT entry 
capability. 

According to CBP officials, CBP has begun to examine the condition of 
each facility with the intent of developing a list of border station 
construction and modification needs and plans to prioritize construction 
projects based on need. In the meantime, CBP and US- VISIT officials told 
us that they have taken steps to address problems operating US-VISIT 
when space constraints are an issue. For example, at the POE in Highgate 
Springs, Vermont, CBP officials told us that US- VISIT computers and those 
needed to process commercial truck drivers and their cargoes were 
competing for space at the interior counter area of the building. Following 
our visit, we were told that the POE had adjusted its space allocation 
inside the POE building so that there are now five workstations for US- 
VISIT and other noncommercial visitor processing, one of which can do 
both. According to the POE assistant area port director, the POE also 
extended the hours during which truck drivers can be processed in a 
separate building designed entirely for processing them and their cargoes, 
in order to relieve the space pressures in the main building that occur 
during the high-volume tourist summer season. 

US- VISIT and CBP officials reported that they have taken other steps to try 
to minimize any problems that may arise integrating US-VISIT entry 
capability operations with other CBP operations. For example, to help 
ensure that US-VISIT does not have an adverse impact on CBP's 
operations at ports of entry, US-VISIT and CBP established a liaison office 
in June 2005, involving supervisory managers detailed from various CBP 
offices. The liaison officers worked with US-VISIT staff to overcome 
operational issues at POEs; review plans; develop and deliver training; set 
up call sites during busy holiday periods to provide support to POEs 
needing assistance; and work through technology problems. A CBP official 
told us that he believes both US- VISIT and CBP have been successful in 
helping land POEs overcome problems as they arise (such as those that 
might occur operating new technology at space constrained facilities). The 
CBP officers detailed to the liaison office have since returned to their 
original duty stations. According to CBP officials, CBP has an open 
invitation to re-initiate the liaison office at any time. 
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While past challenges with facilities are well known to US-VISIT and CBP 
officials and efforts have been made to address them, it is not clear 
whether US-VISIT or CBP is prepared to anticipate additional facilities 
challenges — challenges already acknowledged by senior US- VISIT 
officials — that may arise as new US-VISIT capabilities are added. The 
following two key initiatives, in particular, could affect operations at land 
POEs: 

• 10-fingerprint scanning of US-VISIT enrollees. DHS plans to 
require that individuals subject to US- VISIT undergo a 10-fingerprint 
scan, in place of the current 2, to ensure the highest levels of accuracy 
in identifying people entering and exiting the country. Under this plan, 
US- VISIT visitors would be required to have all fingerprints scanned the 
first time they enroll in US-VISIT and to submit a 2-fmgerprint scan 
during subsequent visits. A cost/benefit analysis of this capability is 
under way by DHS, selected components, and other agencies, with an 
anticipated transition period (from the 2- to 10-fingerprint scan 
requirement) taking place later this year and next. In January 2006, the 
former Director of US- VISIT testified before the Senate Appropriations 
Subcommittee on Homeland Security that in order to introduce a 10- 
fingerprint scan capability at land POEs and other locations, DHS 
would need a 6-to-8-month period to develop the capability and 
additional time to introduce initial operating capability. The former 
Director testified that unresolved technical challenges create the 
potential for a significant increase in the length of time needed to 
process individuals subject to US- VISIT at POEs once the 10-fingerprint 
requirement is in place. 33 In commenting on this report, DHS noted that 
US- VISIT has been working with industry to speed up processing time 
and reduce the size of 10-print capture devices to "eliminate or 
significantly reduce the impact of deploying 10-print scanning." As 
noted earlier, our past work has shown that any lengthening in the 
process of entering the United States at the busiest POEs could 
inconvenience travelers and result in fewer visits to the United States 
or lost business to the nation. 34 



According to this official, there are at least four major unsolved technological challenges 
to 10-fingerprint scanning, including: no current fingerprinting device on the market that 
can take and process 10 prints as quickly as 2; no current device to capture 10 prints from 
the visitor as physically easy as with 2; no current devices meet operational processing 
requirements for ports of entry, embassies, or consulates; and the need to manufacture 
sufficient quantities of scanners to respond to the initiative. 

34 See GAO-03-171. 
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• Electronic passport readers for Visa Waiver Program travelers. 

All Visa Waiver Program travelers with passports issued after October 
26, 2005 must have passports that contain a digital photograph printed 
in the document; passports issued to visa waiver travelers after 
October 26, 2006 must have integrated circuit chips, known as 
electronic passports, which are also called "e-passports." (The Visa 
Waiver Program allows travelers from certain countries to gain entry to 
the United States without a visa.) These e-passports are to contain 
biographic and biometric information that can be read by an e-passport 
reader or scanner, a device which electronically reads or scans the 
information embedded in the e-passport at close proximity, about 4 
inches to the reader. According to DHS, all POEs must have the ability 
to compare and authenticate e-passports as well as visas and other 
travel and entry documents issued to foreign nationals by DHS and the 
Department of State. Earlier this year, DHS announced it had 
successfully tested e-passports and e-passport scanners. A US-VISIT 
Program Office official told us that deployment of these scanners is 
moving toward implementation at POEs located at 34 selected 
international airports where about 97 percent of the Visa Waiver 
Program travelers enter the country. The official said that e-passport 
readers will not initially be installed at land POEs — which process a 
small percentage of visa waiver travelers — and there is no timeline for 
deploying the scanners at land POEs, although there are plans to do so 
at some point. CBP's Director of Automated Programs in the Office of 
Field Operations told us that e-passport readers and the database used 
to process e-passport information do not operate as fast as current 
processes at land POEs and thus could cause additional delays, 
especially at POEs experiencing processing backlogs and wait times, 
such as San Ysidro, California, and Nogales-Mariposa, Arizona. 

Given the potential impact that enhancements to US-VISIT could have 
both on visitor processing overall and on land POE facilities, it is 
important for US- VISIT and CBP to be able to gauge how new changes 
associated with US- VISIT may affect operations. However, our past work 
showed that US- VISIT had not taken all needed steps to help ensure that 
US- VISIT entry capability operates as intended because the approaches 
used to gauge or anticipate the impact of US-VISIT operations on land 
POE facilities was limited. Specifically, in 2005, in an effort to evaluate the 
impact of US- VISIT on the busiest land POEs, DHS completed evaluations 
of the time needed to process and issue the 1-94 arrival/departure form at 5 
POEs. To conduct its study, DHS studied the 1-94 process before and after 
US- VISIT was installed at five land POEs at three locations (Port Huron, 
Michigan; Douglas, Arizona; and Laredo, Texas). Based on data collected 
from these 5 POEs, US- VISIT officials concluded that no additional staff or 
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facility modifications were needed at other POEs in order to accommodate 
US- VISIT. We reported in February 2006 that the scope of this evaluation 
was too limited to determine potential operational impacts on POEs. 35 We 
reported three limitations, in particular: (1) that the evaluations did not 
take into account the impact of US- VISIT on workforce requirements or 
facility needs because the evaluations focused solely on 1-94 processing 
time; (2) that the locations selected were chosen in part because they 
already had sufficient staff to support a US- VISIT pilot-test; and (3) that 
US- VISIT officials did not base their evaluation of 1-94 processing times on 
a constant basis before and after deployment of US- VISIT — that is, pre- 
deployment sites used fewer computer workstations to process travelers 
than did sites studied after deployment. We recommended that DHS 
explore alternative means to obtaining a full understanding of the impact 
of US- VISIT on land POEs, including its impact on workforce levels and 
facilities and that POE sites be surveyed that had not been included in 
their original assessment. US-VISIT responded that wait times at land 
POEs were already known and that it would conduct operational 
assessments at POEs as new projects came online. However, apart from a 
study conducted at one POE facility by a DHS contractor in August 2005 
(cited above), US- VISIT has not provided documentation on any additional 
evaluations conducted that would provide additional insights about the 
effect of US- VISIT on land POE operations, including wait times. 

We recognize that it may not be cost-effective for US-VISIT or CBP to 
conduct a formal assessment of the impact US- VISIT has on each land 
POE now that the entry capability has been installed or of all facilities 
once new enhancements are introduced. Nevertheless, the assessment 
methodology US-VISIT has used in the past — which focused on measuring 
changes in 1-94 processing times — raises questions about how the agency 
will assess the impact that the transition from 2- to 10-fingerprint scanning 
may have on land POE operations. That is, if US- VISIT uses the same 
methodology and focuses on the changes in processing time, rather than 
on the overall impact on operations, including facilities, staffing, and 
support logistics, the results will have the same limitations we highlighted 
in our earlier study. Our February 2006 recommendation would also be 
applicable to enhancements that have the potential to negatively affect 
operations. 



'GAO-06-296. 
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Management Controls Did 
Not Always Alert US-VISIT 
and CBP to Operational 
Problems 



US- VISIT and CBP have management controls in place to alert them to 
operational problems as they occur, but these controls did not always 
work to ensure that US- VISIT operates as intended. Specifically, US- VISIT 
and CBP officials had not been made aware of computer processing 
problems that affected operations, in particular, until we brought them to 
their attention, partly because these problems were not always reported. 
These computer processing problems have the potential to not only 
inconvenience travelers because of the increased time needed to complete 
the inspection process, but to compromise security, particularly if CBP 
officers are unable to perform biometric checks — one of the critical 
reasons US-VISIT was installed at POEs. 



Our standards for internal control in the federal government state that it is 
important for agencies to provide reasonable assurance that they can 
achieve effective and efficient operations. 36 This includes establishing and 
maintaining a control environment that sets a positive and supportive 
attitude toward control activities that are designed to help ensure that 
management's directives are carried out. Control activities include 
reviewing and monitoring agency operations at the functional level (i.e., at 
land POEs) to compare operational performance with planned or expected 
results and to ensure that controls described in policies and procedures 
are actually applied and applied properly, and having relevant, reliable, 
and timely communications to ensure that information flows down, 
across, and up the organization thereby helping program managers carry 
out their responsibilities and providing assurance that timely action is 
taken on implementation problems or information that requires follow-up. 

Our site visit interviews suggest that current monitoring and control 
activities were not sufficient to ensure that US-VISIT performs in 
accordance with its security mission and objectives. For example, at 12 of 
the 21 land POEs we visited, computer-processing problems arose that, 
according to CBP officials at those locations, had an impact on processing 
times and traveler delays. Generally, officials at these 12 sites said that 
computer problems occurred with varying frequency and duration; some 
said that computers were at times slow or froze up during certain times of 
the day, while others said that problems were sporadic and they could not 



'GAO/AIMD-00-21.3.1 and GAO-01-1008G. 
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ascribe them to a particular time of the day. 37 None of the officials we 
interviewed had formally assessed the impact of computer slowdowns or 
freezes on visitors and visitor wait times, but nonetheless cited computer 
problems as a cause of visitor delays. In November 2005, we notified a US- 
VISIT program official in headquarters that we had heard about computer 
processing problems at some of the POEs we had visited. The official told 
us that US-VISIT had not been aware of these problems and said that, as a 
result of our work, CBP had been contacted to investigate the problem. In 
June 2006, a CBP official responsible for information technology at CBP's 
data center told us that POEs had experienced slowdowns associated with 
certain US-VISIT data queries. 38 The CBP official told us that since the 
computer processing problems were identified and resolved, performance 
had greatly improved. We did not verify whether the actions taken fully 
resolved these problems. 

Others have also reported computer processing problems associated with 
US- VISIT. Our review of the report prepared by the contractor hired by 
DHS to study wait times at the POE in Nogales-DeConcini, Arizona 
(discussed earlier) confirmed that slowdowns had occurred at the facility 
during two of the periods covered by its study (June 2005 to August 
2005). 39 According to the contractor, these slowdowns resulted in CBP 



Our review of CBP's information technology "help desk" tickets from July 2005 through 
January 2006 suggested that similar types of problems occurred at other locations where 
US-VTSIT was installed. CBP officers that operate US-VISIT in the field are instructed to call 
the CBP help desk at the Newington Data Center in Virginia if they encounter problems 
operating US-VISIT related software or equipment. 

38 CBP officials also dealt with sporadic network outages. In one case, on December 2, 2005, 
the entire network went down for 3 hours because of an accident. According to port 
officials, visitors seeking entry into the country at the San Ysidro, California, POE were 
initially asked to wait until the systems came back up or return at another time. About an 
hour after the outage began, CBP officers began to manually process I-94s for US-VISIT, in 
accordance with CBP standard operating procedures, but without the benefit of a 
biometric verification of their identity under US-VISIT. 

39 Center for Transportation Research, the University of Texas at Austin. Assessing the 
Effects of US-VISIT RFID Technology Implementation on Vehicle and Pedestrian 
Crossing Times at DeConcini, Nogales, Ariz. Report No. 2 Pilot Data Collection and 
Analysis to Baseline Data (Austin, Texas: November 2005). 
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officers having to revert to manual 1-94 processing without the benefit of 
US- VISIT biometric checks. Specifically, in its reports, the contractor 
noted that: 

". . .on the morning of Thursday, June 23, the computer systems used to perform 
secondary inspections became very slow, impacting the issuance of 1-94 and 
enrollment in US-VTSIT. The staff had to revert to using the paper I-94s, which 
visitors had to fill out by hand..." 

"As happened during the [prior] study, the computer systems were unavailable for 
a period of time. This occurred on Tuesday from 1:00 to 2:00 p.m. Port officials 
decided to revert to the manual process because the network had become very 
slow and the queue was growing. CBP officers told . . . researchers that it was 
taking up to twenty minutes to receive responses to queries...." 

In an undated memorandum commenting on the contractor's report, US- 
VISIT's Director of Mission Operations expressed concern about the 
contractor's discussion of computer "downtime" as a factor impacting US- 
VISIT processing times. He stated that these problems can be caused by a 
variety of factors, including factors related to 1-94 processing and that 
capturing biometric information "is only rarely responsible for the inability 
to complete the process." Based on our work, it is unclear what analysis 
US- VISIT had done to make this determination. 

US- VISIT officials told us that various controls are in place to alert them to 
problems as they occur, but the lack of awareness about computer- 
processing problems raises questions about whether these controls are 
working as intended. US- VISIT officials told us that it is their position that 
once US- VISIT entry capability equipment was installed and operating, 
CBP became responsible for identifying problems and notifying US-VISIT 
when US-VISIT-related problems occurred so that US- VISIT can work with 
CBP to resolve them. The officials stated that computer problems can be 
attributable to other processes and systems not related to US- VISIT which 
are not the US-VISIT Program Office's responsibility. In addition, the 
Acting Director of US- VISIT noted that there are mechanisms in place to 
help CBP and US-VISIT identify problems. For example, US-VISIT officials 
told us that US- VISIT and CBP headquarters officials meet regularly to 
discuss issues associated with US- VISIT implementation and CBP 
maintains a help desk at its Virginia data center to resolve technology 
problems raised by CBP field officials. Regarding the latter, the Acting 
Director noted that if POE officials do not report problems, there is 
nothing CBP and US- VISIT can do to resolve them. During our review, we 
noted that CBP officers are required — in training and as part of standard 
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operating procedures — to report problems with US- VISIT technology to 
the CBP help desk. Nevertheless, CBP officials at 9 of the 12 sites we 
visited where computer processing problems were identified said they did 
not always use the help desk to report or resolve computer problems (and 
thereby generating a record of the problems). Officials at 5 of the 9 sites 
told us they temporarily resolved the problem by turning off and restarting 
the computers. 

Although US-VISIT and CBP have some controls in place to help them 
identify and address problems like those discussed above, these controls 
may not have been implemented consistently or may not be sufficient to 
ensure that US-VISIT operates as intended because officials did not always 
alert CBP and US-VISIT program managers to the fact that problems were 
occurring that adversely affected operations. It is important that US-VISIT 
and CBP managers are alerted to problems as they occur to ensure 
continuity of operations consistent with US- VISIT'S goal of providing 
security to U.S. citizens and travelers. Moreover, in light of the fact that 
US- VISIT plans to enhance security through additional technology 
investments and that it may be challenging to deploy and operate at 
facilities that are already known to be aging and undersized, it is 
incumbent upon the US- VISIT program office to play a continuing and 
proactive role in the management control structure. 

Our internal control standards also call for agencies to establish 
performance measures and indicators throughout the organization so that 
actual performance can be compared to expected results. The US-VISIT 
program office has established and implemented performance measures 
for fiscal years 2005 and 2006 that are designed to gauge performance of 
various aspects of US- VISIT covering a variety of areas, but these 
measures do not gauge the performance of US- VISIT entry capabilities at 
land POEs. For example, according to a July 2006 draft report prepared by 
the US- VISIT program office, US-VISIT has begun to measure the ratio of 
adverse actions (defined as decisions to deny entry into the country) to 
total-biometric-watch-list "hits" when visitors are processed at ports of 
entry. 40 According to US- VISIT, this measure seeks to help CBP focus its 
inspection activities on preventing potential known or suspected criminals 
or terrorists from entering the country. US- VISIT reported that it had not 
established a baseline or target for this measure in fiscal year 2005. 
However, according to US-VISIT, CBP officers at all POEs combined 



40 US-VTSIT, Draft Performance Measures Report (Rosslyn, Va.: July 2006). 
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denied entrance to 30 percent of persons whose biometric information 
appeared on a watch list during fiscal year 2005 (about 617 of the 2,059 
watch list "hits"). US- VISIT established a target for this measure during 
fiscal year 2006 of 33 percent. 

Another measure is designed to gauge the wait time incurred by a specific 
US- VISIT activity at all air, land, and sea POEs, namely the average 
response time to deliver results on biometric watch list queries for finger 
scans. (This measure does not gauge other US- VISIT related activities such 
as scanning the visa or passport, taking and processing a digital 
photograph, or printing an 1-94.) To ensure that wait times are not 
increased substantially due to additional US-VISIT capabilities at POEs, 
US- VISIT has established a goal of 10 seconds and reported that, since 
October 2004, US- VISIT has been able to maintain, on average, less than an 
8-second response time at POEs at which US- VISIT had been installed. 

These and other existing measures of certain key aspects of program 
performance with respect to both security and efficiency can be useful in 
analyzing trends and measuring results against planned or expected 
results. However, because there are operational and facility differences 
among air, sea, and land POEs, it is important to be able to measure and 
distinguish differences — one would not expect baseline or target measures 
to be the same across these environments. At air and sea ports, visitors are 
processed in primary inspection in a controlled environment and CBP 
officers are able to prescreen visitors using passenger manifests, which 
are transmitted to CBP while passengers are enroute to the POE. By 
contrast, at land POEs, visitors arrive on foot or in a vehicle and CBP 
officers refer them to secondary inspection for US-VISIT processing 
without the benefit of a manifest and based on the information available to 
officers at the point of initial contact — a process substantially different 
than that used at air and sea ports. The measures used in August 2006 
aggregated baselines and targets for all POEs and did not distinguish 
among them with regard to air, land, and sea POEs. 

Without additional performance measures to more fully gauge operational 
impacts of US-VISIT on land POEs, CBP and US-VISIT may not be well 
equipped to identify problems, trends, and areas needing improvements 
now and as additional US- VISIT entry capabilities, such as 10-finger scans, 
are introduced. Consistent with our past work, we believe such measures 
could help DHS identify and quantify problems, evaluate alternatives, 
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allocate resources, track progress, and learn from any mistakes that may 
have been made while deploying and operating US-VISIT at land POEs. 41 



DHS Cannot 
Currently Implement 
a Biometric US-VISIT 
Exit Capability at 
Land POEs and Faces 
Uncertainties as 
Testing of an 
Alternative Exit 
Strategy Continues 



While federal laws require the creation of a US-VISIT exit capability using 
biometric verification, the US-VISIT Program Office concluded that 
implementing a biometrically-based exit-recording system like that used to 
record visitors entering the country would require additional staff and new 
infrastructure (such as buildings and roadways) that would be 
prohibitively costly, would likely produce major traffic congestion in exit 
lanes at the busier land POEs and could have adverse impacts on trade 
and commerce. Although current technology does not exist to enable 
biometric verification of those leaving the country without major 
infrastructural changes, US-VISIT officials believe technological advances 
over the next 5- to 10- years will enable them to record who is leaving the 
country using biometrics without requiring travelers to stop at a facility, 
thereby minimizing the need for major infrastructure changes. In the 
interim, US- VISIT is testing an alternative nonbiometric technology for 
recording visitors as they exit the country, in which electronic tags 
containing a numeric identifier associated with each visitor are embedded 
in 1-94 forms. US- VISIT'S own analysis of this technology and our analysis 
and that of others has identified numerous performance and reliability 
problems with this solution, including the inability of the nonbiometric 
solution to ensure that the person exiting the country is the same who 
entered. US-VISIT has taken corrective actions and testing is still ongoing, 
but uncertainties remain about how US- VISIT will use technology in the 
future to meet biometric exit requirements. These uncertainties reflect the 
fact that DHS has not met a June 2005 statutory requirement to submit a 
report to the Congress that describes (1) the status of biometric exit data 
systems already in use at POEs and (2) the manner in which US-VISIT is to 
meet the goal of a comprehensive screening system, with both entry and 
exit biometric capability. 



GAO, Executive Guide: Measuring Performance and Demonstrating Results of 
Information Technology Investments, GAO/AIMD-98-89 (Washington, D.C.: March 1998). 
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Various Factors Have 
Prevented US-VISIT from 
Implementing a Biometric 
Exit Capability 



Federal laws require the creation of a US- VISIT exit capability using 
biometric verification methods to ensure that the identity of visitors 
leaving the country can be matched biometrically against their entry 
records. 42 However, according to officials at the US- VISIT program office 
and CBP and US- VISIT program documentation, there are interrelated 
logistical, technological, and infrastructure constraints that have 
precluded DHS from achieving this mandate, and there are cost factors 
related to the feasibility of implementation of such a solution. The major 
constraint to performing biometric verification upon exit at this time, in 
the US- VISIT Program Office's view, is that the only proven technology 
available would necessitate mirroring the processes currently in use for 
US- VISIT at entry. A mirror-image system for exit would, like entry, require 
CBP officers at land POEs to examine the travel documents of those 
leaving the country, take fingerprints, compare visitors' facial features to 
photographs, and, if questions about identity arise, direct the departing 
visitor to secondary inspection for additional questioning. These steps 
would be carried out for exiting pedestrians as well as for persons exiting 
in vehicles. The US- VISIT Program Office concluded in an internal January 
2005 report assessing alternatives to biometric exit that the mirror-imaging 
solution was "an infeasible alternative for numerous reasons, including but 
not limited to, the additional staffing demands, new infrastructure 
requirements, and potential trade and commerce impacts." 43 



US- VISIT officials told us that they anticipated that a biometric exit 
process mirroring that used for entry could result in delays at land POEs 
with heavy daily volumes of visitors. And they stated that in order to 
implement a mirror-image biometric exit capability, additional lanes for 
exiting vehicles and additional inspection booths and staff would be 
needed, though they have not determined precisely how many. According 
to these officials, it is unclear how new traffic lanes and new facilities 
could be built at land POEs where space constraints already exist, such as 
those in congested urban areas. (For example, San Ysidro, California, 
currently has 24 entry lanes, each with its own staffed booth and 6 
unstaffed exit lanes. Thus, if full biometric exit capability were 
implemented using a mirror image approach, San Ysidro's current capacity 



^Intelligence Reform and Terrorism Prevention Act of 2004, § 7208, 8 U.S.C. § 1365b. See 
also USA PATRIOT Act, Pub. L. No. 107-56, § 414(b)(1), 115 Stat. 272, 353 (2001); 8 U.S.C. § 
1365a(b)(2)-(4). 

43 US-VISIT, Increment 2C Operational Alternatives Assessment — FINAL (Rosslyn, Va.: 
Jan. 31, 2005). 
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of 6 exit lanes would have to be expanded to 24 exit lanes.) As shown in 
figure 6, based on observations during our site visit to the San Ysidro POE, 
the facility is surrounded by dense urban infrastructure, leaving little, if 
any, room to expand in place. Some of the 24 entry lanes for vehicle traffic 
heading northwards from Mexico into the United States appear in the 
bottom left portion of the photograph, where vehicles are shown waiting 
to approach primary inspection at the facility; the six exit lanes (traffic 
towards Mexico), which do not have fixed inspection facilities, are at the 
upper left. 



Figure 6: Aerial View of San Ysidro, California, POE 




Source: GAO. 



Other POE facilities are similarly space-constrained. At the POEs at 
Nogales-DeConcini, Arizona, for example, we observed that the facility is 
bordered by railroad tracks, a parking lot, and industrial or commercial 
buildings. In addition, CBP has identified space constraints at some rural 
POEs. For example, the Thousand Islands Bridge POE at Alexandria Bay, 
New York, is situated in what POE officials described as a "geological 
bowl," with tall rock outcroppings potentially hindering the ability to 
expand facilities at the current location. Officials told us that in order to 
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accommodate existing and anticipated traffic volume upon entry, they are 
in the early stages of planning to build an entirely new POE on a hill about 
a half-mile south of the present facility. CBP officials at the Blaine-Peace 
Arch POE in Washington state said that CBP also is considering whether 
to relocate and expand the POE facility, within the next 5-to-10 years, to 
better handle existing and projected traffic volume. According to the US- 
VISIT program officials, none of the plans for any expanded, renovated, or 
relocated POE include a mirror-image addition of exit lanes or facilities 
comparable to those existing for entry. 

In 2003, the US-VISIT Program Office estimated that it would cost 
approximately $3 billion to implement US-VISIT entry and exit capability 
at land POEs where US-VISIT was likely to be installed and that such an 
effort would have a major impact on facility infrastructure at land POEs. 
We did not assess the reliability of the 2003 estimate. The cost estimate did 
not separately break out costs for entry and exit construction, but did 
factor in the cost for building additional exit vehicle lanes and booths as 
well as buildings and other infrastructure that would be required to 
accommodate a mirror imaging at exit of the capabilities required for entry 
processing. US- VISIT program officials told us that they provided this 
estimate to congressional staff during a briefing, but that the reaction to 
this projected cost was negative and that they therefore did not move 
ahead with this option. No subsequent cost estimate updates have been 
prepared, and DHS's annual budget requests have not included funds to 
build the infrastructure that would be associated with the required 
facilities. 

US- VISIT officials stated that they believe that technological advances 
over the next 5-to-10 years will make it possible to utilize alternative 
technologies that provide biometric verification of persons exiting the 
country without major changes to facility infrastructure and without 
requiring those exiting to stop and/or exit their vehicles, thereby 
precluding traffic backup, congestion, and resulting delays. US- VISIT'S 
report assessing biometric alternatives noted that although limitations in 
technology currently preclude the use of biometric identification because 
visitors would have to be stopped, the use of the as-yet undeveloped 
biometric verification technology supports the long-term vision of the US- 
VISIT program. 44 However, no such technology or device currently exists 



44 US-VTSIT, Increment 2C Operational Alternatives Assessment — FINAL (Rosslyn, Va: 
Jan. 31, 2005). 
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that would not have a major impact on facilities. The prospects for its 
development, manufacture, deployment and reliable utilization are 
currently uncertain or unknown, although a prototype device that would 
permit a fingerprint to be read remotely without requiring the visitor to 
come to a full stop is under development. 

While logistical, technical, and cost constraints may prevent 
implementation of a biometrically based exit technology for US-VISIT at 
this time, it is important to note that there currently is not a legislatively 
mandated date for implementation of such a solution. The Intelligence 
Reform and Terrorism Prevention Act of 2004 requires US- VISIT to collect 
biometric-exit-data from all individuals who are required to provide 
biometric entry data. 45 The act did not set a deadline, however, for 
requiring collection of biometric exit data from all individuals who are 
required to provide biometric entry data. Although US-VISIT had set a 
December 2007 deadline for implementing exit capability at the 50 busiest 
land POEs, US- VISIT has since determined that implementing exit 
capability by this date is no longer feasible, and a new date for doing so 
has not been set. 



The US-VISIT Program 
Office Is Testing 
Nonbiometric Technology 
to Record Travelers' 
Departure 



Because there is at present no biometric technology that can be used to 
verify a traveler's exit from the country at land POEs without also making 
major and costly changes to POE infrastructure and facilities, the US- 
VISIT Program Office sought an alternative means of recording a visitor's 
exit from the country, using nonbiometric technology, that could be tested 
at land POEs. US-VISIT determined that the chosen nonbiometric 
technology would have to meet certain criteria. According to the US-VISIT 
Program Office, the technology would have to: (1) permit recording of an 
exiting visitor in order that stopping or slowing down would not be 
required and privacy issues were addressed; (2) result in no increase in 
wait times for visitors; (3) create no degradation in the level of service at 
exit lanes; (4) create no significant degradation in traffic patterns (that is, 



45 8 U.S.C. § 1365b(d). 

47 US-VISIT evaluated 12 different exit-recording technologies against the six criteria listed 
above, including some that incorporated biometric features — scanning the retina or iris, 
and a facial recognition system. Because the biometric solutions considered would have 
required an exiting visitor to slow down, stop, or possibly enter a POE facility, they were 
rejected. Other alternatives, such as the use of a global positioning system, were rejected 
because they transmit signals that could facilitate surveillance of individuals, raising 
concerns about privacy. 
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no additional traffic congestion); (5) be convenient to the visitor, and (6) 
be commercially available. None of these criteria directly addressed or 
reflected the legislative mandate to deploy a system to record entry and 
exit by foreign travelers using biometric identifiers in order to ensure that 
persons leaving the country were those who had entered. Rather, the 
criteria focused on choosing a technology that would not require a major 
investment in facilities, would protect privacy, and would not generate 
large traffic backups that would inconvenience or delay both travelers and 
commercial carriers. 

Among the technologies considered for testing by the US-VISIT Program 
Office, the only one that met all the US-VISIT evaluation criteria was 
passive, automated, radio frequency identification (RFID). 47 This 
technology, according to US-VISIT, "best satisfied all the assessment 
criteria." RFID is an automated data-capture technology that can be used 
to electronically store information contained on a very small tag that can 
be embedded in a document (or some other physical item). This 
information can then be identified, and recorded as having been identified, 
by RFID readers that are connected to computer databases. 

For purposes of US- VISIT'S testing of the nonbiometric technology, the 
RFID tag is embedded in a modified 1-94 arrival/departure form, called an 
I-94A. Each RFID tag has only a single number stored in it; privacy is 
protected because no information is stored on these tags other than a 
unique ID number that is linked to the visitor's biographic information. To 
facilitate the transmission of the number from the RFID tag, a new DHS 
system of records — the Automated Identification Management System 
(AIDMS) 48 — was created to link the unique RFID tag ID number to existing 
information stored in the Treasury Enforcement Communications System 
(TECS) database, which is used by CBP to verify travel information and 
update traveler data. 49 According to US- VISIT, limiting the data on the tag 
to a single number helps preserve the privacy of travelers; acquisition of 
the number would provide no meaningful information to non-authorized 
persons, since they would then have to access TECS to link the number to 



48 AIDMS is a system separate from TECS, IDENT and other databases used in the US-VISIT 
process. 

49 The Treasury Enforcement Communications System (TECS) is a system that maintains 
lookout (i.e., watch list) data, interfaces with other agencies' databases, and is currently 
used by inspectors at ports of entry to verify traveler information and update traveler data. 
Although still labeled as a Treasury system, TECS has been transferred to CBP. 
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biographic data. However, access to computers and their databases at land 
POEs is restricted to authorized personnel and involves additional 
protections such as passwords as well as entrance into physically 
restricted areas inside POE buildings. (A more detailed discussion of RFID 
technology and privacy issues is contained in appendix VI.) 

The RFID technology used in this way is considered passive because the 
tag cannot initiate communications. Rather, the tag responds to radio 
frequency emissions from an RFID reader — an electronic device that can 
be installed on a pole, or on a steel gantry of the kind that holds highway 
signs over the entire width of a roadway (see figure 11) — and transmits the 
numeric information stored on the tag back to the reader, from up to 30 
feet away, according to the US- VISIT Program Office. Figure 7a shows 
RFID readers mounted on a metal gantry at the Thousand Islands Bridge 
land POE, Alexandria Bay, New York. The readers are attached to metal 
extensions that project out from the right side of the gantry, to record an I- 
94A embedded with tags that are inside the vehicles that pass underneath. 
RFID readers can also be installed in portals or on poles at pedestrian 
traffic areas to read the I-94A embedded with tags of persons leaving the 
country on foot. Figure 7b shows RFID readers in portals positioned on 
either side of pedestrian exit doors at the Blaine-Peace Arch POE in 
Washington State. 
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Figure 7a: Metal Gantry with RFID Readers and Antennas at the Thousand Islands 
Bridge POE, Alexandria Bay, New York 
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Figure 7b: RFID Portals Positioned Next to Exit Doors at the Blaine-Peace Arch POE 
in Washington State 




Source: GAO. 



Initial Results of Testing 
Using RFID Technology 
Indicate Problems Meeting 
a Key Program Goal — 
Verifying the Identity of 
Persons Leaving the 
Country 



In December 2004 and January 2005, a team of US-VISIT contractors 
conducted the first part of a feasibility study to test passive RFID 
equipment in a simulated environment-at a mock POE in Virginia. At this 
site, different types of vehicles- including cars, buses, and trucks — were 
run at different speeds to test RFID read rates. Pedestrians carrying 
documents with RFID tags embedded or attached were not tested. The 
feasibility study raised numerous issues about the reliability and 
performance of the RFID technology. For example, RFID readers held on a 
gantry over a roadway had difficulty detecting RFID-detectable tags that 
were inside vehicles with metallic tinted windows (whether the windows 
were open or closed). The read rate was improved from about 56 percent 
to about 70 percent if the readers were moved to both sides of the road, 
rather than overhead, and if the occupants held their documents with the 
RFID-detectable tags up to the vehicle's side windows. The study 
concluded that the physical actions of the visitor had to be taken into 
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account when obtaining a read of the I-94A and made specific 
recommendations to improve read rates, such as suggesting that vehicle 
occupants hold the I-94A up to a side window and keep multiple forms 
apart. 

After the feasibility study, US-VISIT proceeded, as planned, with phase 1 of 
proof-of-concept testing for RFID at five land POEs at the northern and 
southern borders to determine what corrective actions, if any, should be 
taken to improve RFID read rates for exiting vehicles and pedestrians. 
This effort comprised testing for both exit and for re-entry by persons who 
have been issued a tag-embedded I-94A that is valid for multiple entries 
over several months. 50 The RFID performance tests were conducted for 
one-week periods at land POEs, as follows: 51 vehicular traffic was tested at 
Nogales-Mariposa and Nogales-DeConcini POEs in Nogales, Arizona; the 
Blaine-Pacific Highway and Blaine-Peace Arch POEs in Blaine, 
Washington; and Thousand Islands Bridge POE in Alexandria Bay, New 
York; pedestrian traffic was tested at the Nogales-Mariposa and Nogales- 
DeConcini POEs. 

For these exit tests, the US- VISIT Program Office developed critical 
success factor target read rates to compare them to the actual read rates 
obtained during the test for both pedestrians carrying an I-94A with RFID- 
detectable tags and for travelers in vehicles who also had an RFID- 
detectable I-94A with them inside the vehicles. The target exit read rates 
ranged from an expected success rate of 70 percent to 95 percent, based 
on anticipated performance under different conditions, partly as 
demonstrated in the earlier feasibility study, on business requirements, 
and on a concept of operation plan prepared for Increment 2C. 52 



According to the US-VISIT Program Office, approximately $104 million was budgeted in 
fiscal years 2004 and 2005 to conduct proof-of-concept testing of RFID for exit and re-entry. 
No separate break-out of testing expenditures related to exit alone was available. 

51 Site selection factors included potential physical constraints, such as protected historic 
structures that could hamper installation of gantries, potential environmental impact, daily 
traffic and 1-94 processing volume, speed limits, and weather conditions. 

52 A concept of operations defines how day-to-day operations are (or will be) carried out to 
meet mission needs. The concept of operations includes high-level descriptions of 
information systems, their interrelationships, and information flows. It also describes the 
operations that must be performed, who must perform them, and where and how the 
operations will be carried out. 
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In a January 2006 assessment 53 of the test results, the US- VISIT Program 
Office reported that the exit read rates that occurred during the test 
generally fell short of the expected target rates for both pedestrians and 
for travelers in vehicles. For example, according to US- VISIT, at the 
Blaine-Pacific Highway test site, of 166 vehicles tested, RFID readers 
correctly identified 14 percent; the target read rate was 70 percent. 64 
Another problem that arose was that of cross-reads, in which multiple 
RFID readers installed on gantries or poles picked up information from the 
same visitor, regardless of whether the individual was entering or exiting 
in a vehicle or on foot. Thus, cross-reads resulted in inaccurate record- 
keeping. According to a January 2006 US- VISIT corrective-action report, 
signal-filtering equipment is to be installed to correct the problem and 
additional testing is to be conducted to confirm and understand the extent 
of the problem. The report also noted that remedying cross-reads would 
require changes to equipment and infrastructure on a case-by-case basis at 
each land POE, because each has a different physical configuration of 
buildings, roadways, roofs, gantries, poles, and other surfaces against 
which the signals can bounce and cause cross-reads. Each would therefore 
require a different physical solution to avoid the signal interference that 
triggers cross-reads. Although cost estimates or time lines have not been 
developed for such alterations to facilities and equipment, it is possible 
that having to alter the physical configuration at each land POE in some 
regard and then test each separately to ensure that cross-reads had been 
eliminated would be both time consuming and potentially costly, in terms 
of changes to infrastructure and equipment. 

We observed potential problems with the RFID exit system relating to 
facilities and infrastructure at some of the POEs we visited. At the 
Nogales-Mariposa POE, in Nogales, Arizona, for example, we observed 
that RFID portals for pedestrians had been placed on the right side of the 
CBP POE building, on a rocky, sloping hillside, and that there was no 
signage directing pedestrians to walk between them, nor was a walkway 
installed, as shown in figure 8a. Although travelers were expected to walk 
between the portals, this configuration enabled pedestrians to avoid the 



US-VISIT Program Office, Increment 2C Proof of Concept — Phase 1 Performance 
Evaluation Report, Post Implementation (Rosslyn, VA: Jan. 20, 2006). 

54 A US-VISIT program official explained that for vehicles exiting during RFID testing, one 
could "reasonably expect" a read rate of 70 percent because vehicles are not required to 
stop upon exit. The official also cited vehicle speed, safety, and awareness (of optimal I- 
94A positioning; for example, holding the I-94A up to the window of the vehicle) as factors 
that affected RFID read rates. 
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portals altogether — to walk around them or cross the road to avoid them, 
as shown in figure 8b. 



Figure 8a: RFID Installation at the Nogales-Mariposa POE in Arizona, Facing Toward 
Mexico 




Source: GAO. 
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Figure 8b. Two Pedestrians Exiting the Country at the Nogales-Mariposa POE, 
Arizona, Walking Toward Mexico 




Source: GAO. 



According to the US-VISIT corrective actions report, 15 percent of exiting 
pedestrian (including those participating in the test and those who did not) 
used the pathway between the two portals at the Nogales facility during a 
September 2005 observation period. 55 In this same report, US- VISIT 
acknowledged that there was no defined pathway or infrastructure for 
pedestrian exit at Nogales-Mariposa, Arizona, and that only one of the 
three pedestrian paths were covered by the portals that had been placed 
there. US- VISIT reported that while the placement of the portal readers 
will not be changed, it is taking steps to improve the likelihood of 
detection with additional antennae, readers, and signage. However, there 
are no plans at present to modify the existing POE infrastructure on the 
west side of the building where the portals were installed, such as by 
installing a paved walkway or by constructing fencing to divert those 



TTS-VISIT, Final Increment 2C Phase 1 Proof of Concept Corrective Actions (Rosslyn, Va: 
January 2006). 
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exiting to go through the readers in order to increase the chances that 
exiting pedestrians are detected. In commenting on this report, DHS 
stated that it had constructed a new primary pedestrian exit walkway 
parallel to the existing pedestrian entry and had installed signage, 
sidewalks, and a new secure gate. However, according to a CBP official at 
the Nogales-Mariposa POE, the newly constructed pedestrian exit 
walkway is on the other (east) side of the building from the pathway 
where the portal readers were placed and tested. 

During the period that US-VISIT carried out RFID exit tests at land POEs, 
US- VISIT also tested read rates for RFID-detectable documents carried by 
pedestrians or persons in vehicles who had been issued an I-94A during a 
prior visit to the United States, had subsequently left the country, and were 
intending to re-enter. 56 (I-94s can be issued that are valid for up to 6 
months for multiple re-entries into the country.) US-VISIT performed the 
re-entry test for documents held by persons in vehicles at the Mariposa 
and DeConcini POEs in Nogales, Arizona; the Blaine-Pacific Highway and 
Blaine-Peace Arch, POEs in Washington state; and Thousand Islands 
Bridge POE at Alexandria Bay, New York. For pedestrians, the re-entry 
test was performed at the Mariposa and DeConcini POEs in Nogales, 
Arizona (see tables 6a and 6b, appendix VII). US- VISIT set higher expected 
target read rates for the re-entry test than for exit because all persons and 
vehicles entering or re-entering the country must stop for questioning by 
CBP officers and must take travel documents out of their pockets or from 
inside a vehicle, and show them to the officer, enhancing the likelihood 
that RFID-detectable documents would be detected. As expected by US- 
VISIT, read rates for the re-entry test for vehicles were generally higher 
than for exit, although the results did not meet the critical success factors 
initially projected by US-VISIT. Appendix VII discusses the results of RFID 
performance for exit and re-entry in greater detail. 

Beyond RFID operations issues that affect facilities, our work and that of 
the DHS Privacy Office have identified other performance and reliability 
problems related to passive RFID. In June 2005, we testified before the 
Subcommittee on Economic Security, Infrastructure Protection, and 
Cybersecurity of the House Committee on Homeland Security on similar 



Although all the tests were carried out at five land POEs, the number of POEs tested at 
which pedestrians exit and enter, and vehicles exit and entry differed, due to varying test 
conditions, according to the US-VISIT Program Office. 
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reliability problems with RFID. 57 We noted, for example, that when an 
object close to the reader or tag interferes with the radio waves, read-rate 
accuracy decreases, and that environmental conditions, such as 
temperature and humidity, can make tags unreadable. We further noted 
that tags read at high speeds have a significant decrease in read rates. 

According to US-VISIT officials, phase 2 of the RFID proof-of-concept 
testing, which is to expand the capabilities identified at the five phase 1 
locations will, among other things, link visitor data to vehicle exit data (or 
re-entry, if the visitor already has an RFID- embedded 1-94 form), address 
deficiencies noted in phase 1, and further evaluate RFID performance. At 
the time of our review, many uncertainties about the future of a US- VISIT 
exit capability remained because US-VISIT had not developed a plan to 
show when phase 2 of proof-of-concept testing of RFID would conclude, 
when an evaluation of the technology would be completed, and how US- 
VISIT would define success. 

However, even if RFID deficiencies were to be fully addressed and 
deadlines set, questions remain about DHS's intentions going forward. For 
example, the RFID solution does not meet the congressional requirement 
for a biometric exit capability because the technology that has been tested 
cannot meet a key goal of US- VISIT — ensuring that visitors who enter the 
country are the same ones who leave. By design, an RFID tag embedded in 
an 1-94 arrival/departure form cannot provide the biometric identity- 
matching capability that is envisioned as part of a comprehensive 
entry/exit border security system using biometric identifiers for tracking 
overstays and others entering, exiting, and re-entering the country. 
Specifically, the RFID tag in the 1-94 form cannot be physically tied to an 
individual. This situation means that while a document may be detected as 
leaving the country, the person to whom it was issued at time of entry may 
be somewhere else. 

DHS was to have reported to Congress by June 2005 on how the agency 
intended to fully implement a biometric entry/exit program. As of October 
2006, this plan was still under review in the Office of the Secretary, 
according to US- VISIT officials. According to statute, this plan is to 
include, among other things, a description of the manner in which the US- 



° GAO, Information Security: Key Considerations Related to Federal Implementation of 
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VISIT program meets the goals of a comprehensive entry and exit 
screening system — including both biometric entry and exit — and fulfills 
statutory obligations imposed on the program by several laws enacted 
between 1996 and 2002. 58 Until such a plan is finalized and issued, DHS is 
not able to articulate how entry/exit concepts will fit together — including 
any interim nonbiometric solutions — and neither DHS nor Congress is 
positioned to prioritize and allocate resources for a US-VISIT exit 
capability or plan for the program's future. 

In commenting on this report, DHS acknowledged that the interim non- 
biometric exit technology using RFID tags embedded in the 1-94 does not 
meet the statutory requirement for a biometric exit capability. DHS stated 
that it used the non-biometric technology because industry was not to the 
point of developing a device that could satisfy US-VISIT requirements, 
such as not impacting traffic flows or not having safety impacts. DHS said 
that US- VISIT officials would perform subsequent research and industry 
outreach activities in an attempt to satisfy statutory requirements for a 
biometric exit capability. 



In recent years, DHS has planned or implemented a number of initiatives 
aimed at securing the nation's borders. However, DHS has not defined a 
strategic context that shows how US-VISIT fits with other land border 
initiatives. As we reported in September 2003, agency programs need to 
properly fit within a common strategic context governing key aspects of 
program operations — e.g., what functions are to be performed by whom; 
when and where they are to be performed; what information is to be used 
to perform them; what rules and standards will govern the application of 
technology to support them; and what facility or infrastructure changes 
will be needed to ensure that they operate in harmony and as intended. 59 
Without a clear strategic context for US-VISIT, the risk is increased that 
the program will not operate with related programs and thus not cost- 
effectively meet mission needs. 

In our September 2003 report, we stated that DHS had not defined key 
aspects of the larger homeland security environment in which US-VISIT 
would need to operate. For example, certain policy and standards 



oh 8U.S.C. §1365b(c)(2)(E). 

o9 GAO, Homeland Security: Risks Facing Key Border and Transportation Security 
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decisions had not been made, such as whether official travel documents 
would be required for all persons who enter and exit the country, 
including U.S. and Canadian citizens, and how many fingerprints would be 
collected — factors that could potentially increase inspection times and 
ultimately increase traveler wait times at some of the higher volume land 
POE facilities. To minimize the impact of these changes, we recommended 
that DHS clarify the context in which US-VISIT is to operate. Three years 
later, defining this strategic context remains a work in progress. Thus, the 
program's relationships and dependencies with other closely allied 
initiatives and programs are still unclear. 

According to the US- VISIT Chief Strategist, the Program Office drafted in 
March 2005 a strategic plan that showed how US- VISIT would be 
strategically aligned with DHS's organizational mission and also defined an 
overall vision for immigration and border management. 60 According to this 
official, the draft plan provided for an immigration and border 
management enterprise that unified multiple internal departmental and 
other external stakeholders with common objectives, strategies, 
processes, and infrastructures. As of October 2006, we were told that DHS 
had not approved this strategic plan. This draft plan was not available to 
us, and it is unclear how it would provide an overarching vision and road 
map of how all these component elements can at this time be addressed 
given that critical elements of other emerging border security initiatives 
have yet to be finalized. For example, under the Intelligence Reform and 
Terrorism Prevention Act of 2004, DHS and State are to develop and 
implement a plan, no later than June 2009, which requires U.S. citizens and 
foreign nationals of Canada, Bermuda, and Mexico to present a passport 
or other document or combination of documents deemed sufficient to 
show identity and citizenship to enter the United States (this is currently 
not a requirement for these individuals entering the United States via land 
POEs from within the western hemisphere). This effort, known as the 
Western Hemisphere Travel Initiative (WHTI), was first announced in 
2005, and some members of Congress and others have raised questions 
about agencies' progress carrying out WHTI. In May 2006, we issued a 
report that provided our observations on efforts to implement WHTI along 



60 In commenting on this report, DHS stated that this plan includes US-VISIT's draft 
response to the legislative requirement that DHS produce a report to the Congress by June 
2005 that describes a comprehensive US-VISIT entry/exit screening system, as discussed 
earlier in this report. 
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the U.S. border with Canada. 61 We stated that DHS and State had taken 
some steps to carry out the Travel Initiative, but they had a long way to go 
to implement their proposed plans, and time was slipping by. Among other 
things, we found that: 

• key decisions had yet to be made about what documents other than a 
passport would be acceptable when U.S. citizens and citizens of 
Canada enter or return to the United States — a decision critical to 
making decisions about how DHS is to inspect individuals entering the 
country, including what common facilities or infrastructure might be 
needed to perform these inspections at land POEs; 

• a DHS and Department of State proposal to develop an alternative form 
of passport, called a PASS card, would rely on RFID technology to help 
DHS process U.S. citizens re-entering the country, but DHS had not 
made decisions involving a broad set of considerations that include (1) 
utilizing security features to protect personal information, (2) ensuring 
that proper equipment and facilities are in place to facilitate crossings 
at land borders, and (3) enhancing compatibility with other border 
crossing technology already in use. 

As of September 2006, DHS had still not finalized plans for changing the 
inspection process and using technology to process U.S. citizens and 
foreign nationals of Canada, Bermuda, and Mexico reentering or entering 
the country at land POEs. In the absence of decisions about the strategic 
direction of both programs, it is still unclear (1) how the technology used 
to facilitate border crossings under the Travel Initiative will be integrated 
with US-VISIT technology, if at all, and (2) how land POE facilities would 
have to be modified to accommodate both programs to ensure efficient 
inspections that do not seriously affect wait times. This raises the 
possibility that CBP would be faced with managing differing technology 
platforms and border inspection processes at high-volume land POEs 
facilities that, according to DHS, already face space constraints and 
congestion. 

Similarly, it is not clear how US-VISIT is to operate in relation to another 
emerging border security effort, the Secure Border Initiative (SBI) — a new 
comprehensive DHS initiative, announced last year, to secure the 
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country's borders and reduce illegal migration. According to DHS, as of 
June 2006, SBI is to focus broadly on two major themes: 

• border control — gaining full control of the borders to prevent illegal 
immigration, as well as security breaches, and 

• interior enforcement — disrupting and dismantling cross border crime 
into the interior of the United States while locating and removing aliens 
who are present in the United States in violation of law. 

Under SBI and its CBP component, called SBInet, DHS plans to use a 
systems approach to integrate personnel, infrastructures, technologies, 
and rapid response capability into a comprehensive border protection 
system. DHS reports that, among other things, SBInet is to encompass 
both the northern and southern land borders, including the Great Lakes, 
under a unified border control strategy whereby CBP is to focus on the 
interdiction of cross-border violations between the ports and at the official 
land POEs and funnel traffic to the land POEs. 

DHS has recently awarded a contract to help DHS design, build, and 
execute SBInet. Although DHS has published some information on various 
aspects of SBI and SBInet, it remains unclear how SBInet will be linked, if 
at all, to US- VISIT so that the two systems can share technology, 
infrastructure, and data across programs. For example, from a border 
control perspective, questions arise on whether CBP needs additional 
resources, facilities or facility modifications, and procedural changes at 
land POEs if all those who attempt to enter the country on the northern 
and southern border are successfully funneled to land POEs. 

Also, given the absence of a comprehensive entry and exit system, 
questions remain about what meaningful data US-VISIT may be able to 
provide other DHS components, such as Immigration and Customs 
Enforcement (ICE), to ensure that DHS can, from an interior enforcement 
perspective, identify and remove foreign nationals covered by US- VISIT 
who may have overstayed their visas. In a May 2004 report, we stated that 
although no firm estimates were available, the extent of overstaying is 
significant. 62 We stated that most long-term overstays appeared to be 
motivated by economic opportunities, but a few had been identified as 
terrorists or involved in terrorist-related activities. Notably, some of the 
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September 11 hijackers had overstayed their visas. We further reported 
that US-VISIT held promise for identifying and tracking overstays as long 
as it could overcome weaknesses matching visitors' entry and exit. 



Developing and deploying complex technology that records the entry and 
exit of millions of visitors to the United States, verifies their identities to 
mitigate the likelihood that terrorists or criminals can enter or exit at will, 
and tracks persons who remain in the country longer than authorized is a 
worthy goal in our nation's effort to enhance border security in a post-9/11 
era. But doing so also poses significant challenges; foremost among them 
is striking a reasonable balance between US-VISIT's goals of providing 
security to U.S. citizens and visitors while facilitating legitimate trade and 
travel. DHS has made considerable progress making the entry portion of 
the US- VISIT program at land ports of entry (POEs) operational, and 
border officials have clearly expressed the benefits that US- VISIT 
technology and biometric identification tools have afforded them. 
Nevertheless, US- VISIT is one in a series of ambitious border security 
initiatives that could take a toll on the current facilities and infrastructure 
in place to support the activities at land POEs, which already process a 
large majority (more than 75 percent) of all visitors entering the United 
States via legal checkpoints. Many land POEs operate out of small, aging 
structures that are constrained by space and that were constructed before 
technology and associated equipment played a prominent role in 
processing activities. 

Our current and past work has raised questions on whether DHS has 
adequately assessed how US-VISIT has affected operations at land POEs, 
given current constraints at facilities that routinely experience high traffic 
volumes and which encounter occasional computer-processing problems. 
As additional US- VISIT capabilities — such as 10-fmgerprint scanning — are 
installed at land POEs and as other border security initiatives unfold, 
including the Western Hemisphere Travel Initiative, it is particularly 
important that DHS be able to anticipate potential problems and develop 
solutions to minimize any operational and logistical impacts on aging and 
already overcrowded land POE facilities. Our earlier recommendation on 
this issue suggested that DHS needed to expand upon prior efforts to 
assess the impact of US- VISIT on busy land POEs in order to obtain a 
fuller understanding of the system's impact on these facilities from an 
operational and human capital perspective. We believe this remains an 
important step to take because it would help DHS establish a baseline or 
foundation from which to anticipate potential problems while providing a 
framework for developing strategies and action plans to overcome them. 
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Although US-VISIT has said it would conduct operational assessments at 
POEs as new projects came online, the assessment methodology US- VISIT 
has used in the past — which focused on measuring changes in 1-94 
processing times — raised questions about how the agency will perform 
future assessments. 

In addition, because US- VISIT will likely continue to have an impact on 
land POE facilities as it evolves, it is important for US-VISIT and CBP 
officials to have sufficient management controls for identifying and 
reporting potential computer and other operational problems as they 
arise — problems that could affect the ability of US-VIST entry capability to 
operate as intended. If additional delays in processing visitors were to 
occur, the ability of POE facilities to handle additional vehicular and 
pedestrian traffic could be further strained, and incidents requiring 
officials to turn visitors away temporarily may increase. Likewise, if 
disruptions to US-VISIT computer operations are not consistently and 
promptly reported and resolved and if communication between CBP and 
US- VISIT officials about computer-related problems and other operational 
challenges is not effective, then it is possible that a critical US- VISIT 
function — notably, the ability to use biometric information to confirm 
visitors' identities through various databases — could be disrupted, as has 
occurred in the past. The need to avoid disruptions to biometric 
verification is important given that one of the primary goals of US- VISIT is 
to enhance the security of U.S. citizens and visitors, and in light of the 
substantial investment DHS has made in US- VISIT technology and 
equipment. 

US- VISIT has taken appropriate steps to develop performance measures 
that focus on various aspects of US-VISIT performance across air, land, 
and sea POEs. However, these measures do not go far enough to assess 
the affect of US- VISIT on POE operations, particularly land POEs, which 
are operationally distinctive from air and sea POEs where US-VISIT entry 
has also been installed. Such measures are needed to ensure that officials 
can identify and address problems at land-based facilities where 
improvements may be needed. 

With respect to DHS's effort to create an exit verification capability, 
developing and deploying this capability for US- VISIT at land POEs has 
posed a set of challenges that are distinct from those associated with 
entry. US-VISIT has not determined whether it can achieve, in a realistic 
time frame, or at an acceptable cost, the legislatively mandated capability 
to record the exit of travelers at land POEs using biometric technology. 
Apart from acquiring new facilities and infrastructure at an estimated cost 
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of billions of dollars, US-VISIT officials have acknowledged that no 
technology now exists to reliably record travelers' exit from the country, 
and to ensure that the person leaving the country is the same person who 
entered, without requiring them to stop upon exit — potentially imposing a 
substantial burden on travelers and commerce. US-VISIT officials stated 
that they believe a biometrically based solution that does not require those 
exiting the country to stop for processing, that minimizes the need for 
major facility changes, and that can used to definitively match a visitor's 
entry and exit will be available in 5 to 10 years. In the interim, it remains 
unclear how officials plan to proceed — whether a nonbiometric alternative 
now being tested can provide an acceptable interim solution or whether 
the government ought to wait for a viable biometric solution to become 
available. According to statute, DHS was required to report more than a 
year ago on its plans for developing a comprehensive biometric entry and 
exit system, but DHS has yet to finalize this road map for Congress. 
Reporting might provide better assurance that US-VISIT can balance its 
goals of providing security, serving the immigration system, facilitating 
trade and travel, and protecting privacy at land POEs. This plan would also 
give DHS the opportunity to discuss the costs, benefits, barriers, and 
opportunities associated with various strategies for deploying biometric 
and nonbiometric exit capabilities and keep Congress informed of its 
progress overall. Until DHS finalizes such a plan, neither Congress nor 
DHS are likely to have sufficient information as a basis for decisions about 
various factors relevant to the success of US- VISIT, ranging from funding 
needed for any land POE facility modifications in support of the 
installation of exit technology to the trade-offs associated with ensuring 
traveler convenience while providing verification of travelers' departure 
consistent with US- VISIT'S national security and law enforcement goals. 

Finally, DHS has not articulated how US- VISIT fits strategically and 
operationally with other land-border security initiatives, such as the 
Western Hemisphere Travel Initiative and Secure Border Initiative. 
Without knowing how US-VISIT is to be integrated within the larger 
strategic context governing DHS operations, DHS faces substantial risk 
that US- VISIT will not align or operate with other initiatives at land POEs 
and thus not cost-effectively meet mission needs. Knowing how US- VISIT 
is to work in harmony with these initiatives could help Congress, DHS, and 
others better understand what resources, tools, and investments in land 
POE facilities and infrastructure are needed to ensure their success, while 
providing critical information to help make decisions about other DHS 
missions. This could include, for example, information on what funds and 
staffing resources ICE would need to enforce immigration laws if US- VISIT 
were able to provide reliable and timely information on potentially 
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millions of persons who have overstayed the terms of their visas, some of 
whom may pose a threat to the nation's security. 



R6COmm6ndcltiori.S for ^° acn i eve benefits commensurate with its investment in US- 

VISIT at land POEs and security goals and objectives, we are 

Executive Action recommending that the Secretary of Homeland Security direct the US- 

VISIT Program Director, in collaboration with the Commissioner of CBP, 
to take the following two actions: 

• improve existing management controls for identifying and reporting 
computer processing and other operational problems as they arise at 
land POEs and ensure that these controls are consistently 
administered; and 

• develop performance measures for assessing the impact of US-VISIT 
operations specifically at land POEs. 

We also recommend that as DHS finalizes the statutorily mandated report 
describing a comprehensive biometric entry and exit system for US-VISIT, 
the Secretary of Homeland Security take steps to ensure that the report 
include, among other things, 

• information on the costs, benefits, and feasibility of deploying 
biometric and nonbiometric exit capabilities at land POEs; 

• a discussion of how DHS intends to move from a nonbiometric exit 
capability, such as the technology currently being tested, to a reliable 
biometric exit capability that meets statutory requirements; and 

• a description of how DHS expects to align emerging land border 
security initiatives with US- VISIT and what facility or facility 
modifications would be needed at land POEs to ensure that technology 
and processes work in harmony. 



Agency Comments 
and Our Evaluation 



We requested comments on a draft of this report from the Secretary of 
Homeland Security. In an October 31, 2006, letter, DHS provided written 
comments, which are summarized below and included in their entirety in 
appendix VIII. 



DHS generally agreed with our recommendations and stated that it needed 
to improve existing management controls associated with US-VISIT, 
develop performance measures to assess the impact of US-VISIT 
operations at land POEs, and ensure that the statutorily mandated report 
describes how DHS will move to a biometric entry and exit capability and 
align US- VISIT with emerging land border initiatives. DHS did not provide 
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timelines for when it plans to take these steps, including finalizing the 
statutorily mandated report, which was to have been issued to the 
Congress in June 2005. 

DHS disagreed with certain aspects of or sought clarification on some of 
our findings. DHS disagreed with our finding that the US- VISIT program 
office did not fully consider the impact of US-VISIT on the overall 
operations at POEs. It said that US- VISIT impacts are limited to changes 
in Form 1-94 processing time, which it says are positive, as supported by 
US- VISIT evaluations. According to DHS other factors related to capacity, 
staffing, and the volume of travelers are "arguably" beyond the scope of 
US-VISIT. 

We agree that the approach taken to do operational assessments of the 
impact of US- VISIT land POE facilities focused on changes to 1-94 
processing time and that a variety of factors and processes can affect 
traveler inspections and associated wait times at land POEs. However, as 
discussed in this and our February 2006 report, the assessment 
methodology US-VISIT has used thus far had limitations-including 
focusing solely on 1-94 processing time. 63 Unanticipated problems at 
facilities that routinely experience high traffic volumes and occasionally 
encounter computer processing shortfalls raise questions about whether 
DHS has adequately assessed how US-VISIT has affected operations at 
land POEs. Although it may not be cost-effective for US-VISIT or CBP to 
conduct a formal assessment of the impact of US- VISIT at each land POE, 
it is important that DHS be positioned to anticipate potential problems and 
develop solutions to minimize any operational and logistical impacts on 
aging and already overcrowded land POE facilities. This is especially true 
given that DHS recognizes that the transition from 2- to 10-print digital 
scanning has a high likelihood of impacting port facilities. 

Regarding the latter, we have amended our report to clarify, consistent 
with DHS's comments, that US-VISIT is currently working with industry to 
speed up processing time and reduce the size of the 10-print capture 
devices to "eliminate or significantly reduce the impact of deploying 10- 
print scanning." DHS efforts to work with industry highlights the need to 
more fully assess how US-VISIT affects land POEs so that potential 
problems can be identified and addressed before the readers, or any other 
new programs, are introduced at land POEs. As noted in our report, based 
on our past work, any lengthening in the process of entering the United 
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States at the busiest land POEs could inconvenience travelers and result in 
fewer visits to the United States or lost business to the nation. 64 

DHS also suggested that we clarify its acknowledgement that the non- 
biometric technology tested did not meet the statutory requirement for 
biometric exit capability. DHS stated that the non-biometric technology 
was used because industry has yet to develop a biometric exit device that 
could satisfy mission requirements such as not impacting traffic flow and 
not having safety impacts. We have amended our report to clarify that 
DHS acknowledged that the non-biometric technology would not satisfy 
statutory requirements and to reflect that it would perform research and 
industry outreach to satisfy the mandate. Nonetheless, the fact that the 
non-biometric exit technology used does not satisfy the congressionally 
mandated biometric exit capability underscores the importance of our 
recommendation for DHS to clearly articulate how it plans to move from a 
non-biometric exit technology to a biometric exit solution. 

In addition, DHS suggested that we clarify that, with regard to the RFID 
pedestrian exit portals at the Nogales-Mariposa, Arizona, POE, it had 
constructed a new primary pedestrian exit walkway parallel to the existing 
pedestrian entry and had installed signage, sidewalks, and a new secure 
gate. We have amended the report to include information about the new 
pedestrian exit walkway. However, as we noted in our report, portals 
were installed only on one of the three pedestrian pathways used to exit 
the United States. According to a CBP official at the Nogales-Mariposa 
POE, the newly constructed pedestrian exit walkway is on the other side 
of the building from the pathway where the portal readers were placed 
and tested and thus would not mitigate the vulnerabilities we identified. 

Finally, DHS provided other comments that we considered technical in 
nature. We have amended our report to incorporate these clarifications, 
where appropriate. 



As agreed with your offices, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days after the 
issuance date of our original report, which, as discussed earlier, was 
classified For Official Use Only. At that time, we will provide copies of 
this report to appropriate departments and interested congressional 
committees. We will also make copies available to others upon request. 
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In addition, this report will be available on GAO's Web site at 
http://www.gao.gov. 

If you or your staff have any questions about this report or wish to discuss 
the matter further, please contact me at (202) 512-8777 or stanar@gao.gov. 
Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this report. Major contributors to 
this report are listed in appendix IX. 




Richard M. Stana 

Director, Homeland Security and Justice Issues 
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Appendix I: Objective, Scope, and 
Methodology 



This report addresses the progress the Department of Homeland Security 
and U.S. Customs and Border Protection (CBP) have made in 
implementing the United States Visitor Status Indicator Technology (US- 
VISIT) program at existing land Ports of Entry (POE). Specifically, we 
analyzed the following issues: (1) What has the US- VISIT Program Office 
done to implement US- VISIT entry capabilities at land POEs and what 
impact has US- VISIT had on these facilities? (2) What is the status of US- 
VISIT Program Office efforts to implement a US-VISIT exit capability at 
land POE facilities? (3) What has DHS done to define a strategic context to 
show how US- VISIT entry and exit capabilities at land POE facilities fit 
with other current and emerging border security initiatives? 

We performed our work at the Department of Homeland Security's US- 
VISIT Program Office and CBP. We also carried out work at 21 of 154 land 
POEs where US- VISIT entry capability had been installed. At 3 of these 21 
land POEs, DHS was also testing exit capability. Table 3 shows the 21 land 
POEs we visited, by location and state, between August 2005 and February 
2006. 
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Appendix I: Objective, Scope, and 
Methodology 



Table 3: Land POEs visited by GAO, August 2005 to February 2006 


POE Name 


Location 


State 


Northern border 


Ambassador Bridge 
Detroit-Windsor Tunnel 


Detroit 


Mich. 


Overton Corners 
St. John's Hwy. 
Thousands Island Bridge 
Champlain 


Rouses Point 

Alexandria Bay 
Champlain 


N.Y. 


Highgate Springs 
Alburg 


Highgate Springs 
Alburg 


Vt. 


Peace Arch 
Pacific Highway 


Blaine 


Wash. 


Southern border 


DeConcini 
Morley Gate 
Mariposa 


Nogales 


Ariz. 


San Ysidro 


San Diego 


Calif. 


Los Tomates 
Gateway 

Brownsville Matamoros Bridge 

Hidalgo 

Progreso 

Los Ebanos 

Pharr 


Brownsville 

Hidalgo 
Progreso 
Los Ebanos 
Pharr 


Tex. 



Source: GAO. 



In selecting land POEs to visit, we originally selected 10 land POEs on the 
northern border and 10 POEs on the southern border based on geographic 
dispersion along the border and taking into consideration POEs that were 
located near each other to minimize travel costs. We added the Morley 
Gate POE after we initially selected sites because it is physically located 
about 100 yards from the DeConcini POE in downtown Nogales (Ariz.) and 
after learning that US-VISIT was treating Morley Gate as a stand-alone 
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Appendix I: Objective, Scope, and 
Methodology 



POE for US- VISIT deployment purposes. 1 In making our selections, we 
also considered US- VISIT deployment schedules, facility size, and the 
number of border crossings and 1-94 issuances. 2 Fifteen of the 21 selected 
sites in our study were among the 50 busiest land POEs for which US- 
VISIT entry capability was to be operating by December 31, 2004, as 
required by law. The other 6 sites were among those remaining POEs 
where, according to law, US- VISIT entry capability was to be operating by 
December 31, 2005. While selecting sites, we also included the five POEs 
at which the US- VISIT program office was testing radio frequency 
identification (RFID) technology as part of a proof of concept for meeting 
US- VISIT exit capability requirements. These were: Blaine-Peace Arch; 
Blaine-Pacific Highway; Thousand Islands Bridge, Alexandria Bay; 
Nogales-Mariposa; and Nogales-DeConcini. The information from our site 
visits is limited to the 21 POEs we visited and is not generalizable to the 
remaining POEs. 

To examine what the US-VISIT Program Office has done to implement US- 
VISIT entry capabilities at land POEs and what impact US- VISIT has had 
on these facilities, we interviewed US- VISIT and CBP headquarters 
officials as well as CBP officials at the 21 locations we visited. We 
obtained and analyzed available DHS reports on US-VISIT entry capability 
planning, deployment, and operations across land POEs, including the 21 
we visited. At the 21 locations, we (1) discussed US- VISIT entry capability 
deployment at the facility, any facility-related barriers or constraints 
encountered during installation, and any operational issues encountered 
since and (2) obtained any available documentation about US- VISIT 
deployment and operations at the facility. We also toured secondary 
inspection at each facility to observe what US-VISIT equipment was 
installed, how it was installed, and where possible, how it operated when 
visitors covered by US- VISIT arrived at the facility for processing into the 
country. While doing our site visits, we met with US-VISIT and CBP 
officials at headquarters to discuss our field work; discern why problems 
we identified in the field may have occurred, and if problems occurred, 
gather and analyze available US-VISIT and CBP information about those 



1 At the time we selected sites for review, we were unaware that the Morley Gate POE was 
being treated as a land POE separate from the other land POEs at Nogales. However, since 
US-VTSIT treated Morley Gate as a separate POE for deployment, we also counted it as a 
stand alone POE. 

2 During fiscal year 2004, the number of 1-94 issuances by the 21 selected sites ranged from 
22 in Alburg Springs to about 398,900 in San Ysidro. 
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problems, including information on any corrective actions. We also 
examined whether internal or management controls were in place to alert 
officials to the problems we identified, and examined whether these 
controls were being applied, consistent with GAO's Standards for Internal 
Controls in the Federal Government. 3 In addition, we interviewed CBP and 
US- VISIT headquarters officials about plans for installing and operating 
new technology and equipment related to US- VISIT, such as 10-finger-scan 
readers, at land POEs; reviewed available DHS documents about plans to 
implement these devices; and reviewed available DHS documents that 
discussed performance measures for US-VISIT overall. We also reviewed 
applicable laws, regulations, and DHS federal register notices pertaining to 
US- VISIT entry capability deployment at land POEs, as well as reports 
prepared by DHS, GAO, the DHS Office of Inspector General, and the 
Congressional Research Service. 

To determine the status of DHS's efforts to implement a US-VISIT exit 
capability at land POEs, we interviewed US-VISIT and CBP headquarters 
officials and CBP officials at the five locations where US-VISIT exit 
capability was being tested (Nogales-Mariposa, Nogales-DeConcini, 
Blaine-Pacific Highway, Blaine-Peace Arch, and Alexandria Bay). At each 
of the locations, we toured the areas where exit testing equipment and 
technology had been installed and discussed with CBP officials how it was 
installed and to be tested. We also reviewed applicable laws and 
regulations and obtained and analyzed available DHS reports on US- VISIT 
exit capability including an operational alternatives assessment; feasibility 
studies; and proof of concept performance evaluation and corrective 
action reports. Our analysis of these reports focused on DHS strategies for 
selecting, testing, acquiring, and evaluating alternative methods that could 
meet the requirements; DHS's criteria used to select and test the potential 
of RFID technology; and the challenges encountered, including any 
privacy issues associated with RFID use. Finally, we obtained and 
analyzed DHS reports on the costs of the equipment and related facility 
infrastructure, such as the metal gantry erected over roadways to hold 
RFID readers, to estimate what it would cost to install RFID equipment at 
all land POEs. We developed our overall estimate based on the average 
cost to date (about $1 million each) of installing exit gantries and 
associated RFID equipment at the four POEs where gantries and 
equipment were installed. (Although RFID use was tested at five POEs, at 
the DeConcini POE in downtown Nogales, Arizona, the RFID readers were 



3 See GAO/AIMD-00-21.3.1 and GAO-01-1008G. 
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placed on poles on either side of entry lanes, since all entering vehicles 
pass under a large permanent canopy structure that precludes installing a 
gantry. At the other four POEs, RFID readers were attached to metal 
gantries placed over roadway lanes.) 

To examine what DHS has done to define a strategic context to show how 
US- VISIT entry and exit capabilities at land POE facilities fit with other 
current and emerging border security initiatives, we reviewed past GAO 
reports and public DHS announcements about the Western Hemisphere 
Travel Initiative and the Secure Border Initiative (SBI). We also 
interviewed DHS officials about the status of efforts to implement these 
initiatives as well as the status of efforts to develop and promulgate a 
strategic plan for US-VISIT and compared available information on DHS 
plans to implement initiatives with the results of our discussions with US- 
VISIT program officials. 

We conducted our work from September 2005 through October 2006 in 
accordance with generally accepted government auditing standards. 
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The Department of State's (State) Visa Waiver Program (VWP) enables 
nationals of certain countries to travel to the United States for tourism or 
business for stays of 90 days or less without obtaining a visa. The program 
was established in 1986 with the objective of promoting better relations 
with U.S. allies, eliminating unnecessary barriers to travel, stimulating the 
tourism industry, and permitting the Department of State to focus consular 
resources in other areas. VWP eligible travelers may apply for a visa, if 
they prefer to do so. Not all countries participate in the VWP, and not all 
travelers from VWP countries are eligible to use the program. VWP 
travelers are screened prior to admission into the United States, and they 
are enrolled in the Department of Homeland Security's US- VISIT program. 
Currently, 27 countries participate in the Visa Waiver Program as shown in 
the following table. 



Table 4: Countries Participating in the Visa Waiver Program 


Andorra 


Iceland 


Norway 


Australia 


Ireland 


Portugal 


Austria 


Italy 


San Marino 


Belgium 


Japan 


Singapore 


Brunei 


Liechtenstein 


Slovenia 


Denmark 


Luxembourg 


Spain 


Finland 


Monaco 


Sweden 


France 


The Netherlands 


Switzerland 


Germany 


New Zealand 


United Kingdom 



Source: Department of State. 
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The Illegal Immigration Reform and Immigrant Responsibility Act of 1996 
originally required the development of an automated entry and exit control 
system to collect a record of departure for every alien departing the United 
States and match the record of departure with the record of the alien's 
arrival in the United States; make it possible to identify nonimmigrants 
who remain in the country beyond the authorized period; and not 
significantly disrupt trade, tourism, or other legitimate cross-border traffic 
at land border ports of entry. It also required the integration of overstay 
information into appropriate databases of the INS and the Department of 
State, including those used at ports of entry and at consular offices. The 
system was originally to be developed by September 30, 1998; this deadline 
was changed to October 15, 1998, and was changed again for land border 
ports of entry and sea ports to March 30, 2001. 

The Immigration and Naturalization Service Data Management 
Improvement Act (DMIA) of 2000 replaced the 1996 statute in its entirety, 
requiring instead an electronic system that would provide access to and 
integrate alien arrival and departure data that are authorized or required to 
be created or collected under law, are in an electronic format, and are in a 
data base of the Department of Justice or the Department of State, 
including those created or used at ports of entry and at consular offices. 
The Act specifically provided that it not be construed to permit the 
imposition of any new documentary or data collection requirements on 
any person for the purpose of satisfying its provisions, but it further 
provided that it also not be construed to reduce or curtail any authority of 
the Attorney General (now Secretary of Homeland Security) or Secretary 
of State under any other provision of law. The integrated entry and exit 
data system was to be implemented at airports and seaports by December 
31, 2003, at the 50 busiest land ports of entry by December 31, 2004, and at 
all remaining ports of entry by December 31, 2005. 

The DMIA also required that the system use available data to produce a 
report of arriving and departing aliens by country of nationality, 
classification as an immigrant or nonimmigrant, and date of arrival in and 
departure from the United States. The system was to match an alien's 
available arrival data with the alien's available departure data, assist in the 
identification of possible overstays, and use available alien arrival and 
departure data for annual reports to Congress. These reports were to 
include the number of aliens for whom departure data were collected 
during the reporting period, with an accounting by country of nationality; 
the number of departing aliens whose departure data was successfully 
matched to the alien's arrival data, with an accounting by country of 
nationality and classification as an immigrant or nonimmigrant; the 
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number of aliens who arrived pursuant to a nonimmigrant visa, or as a 
visitor under the visa waiver program, for whom no matching departure 
data have been obtained as of the end of the alien's authorized period of 
stay, with an accounting by country of nationality and date of arrival in the 
United States; and the number of identified overstays, with an accounting 
by country of nationality. 

In 2001, the USA PATRIOT Act provided that, in developing the integrated 
entry and exit data system under the DMIA, the Attorney General (now 
Secretary of Homeland Security) and Secretary of State were to focus 
particularly on the utilization of biometric technology and the 
development of tamper-resistant documents readable at ports of entry. It 
also required that the system be able to interface with law enforcement 
databases for use by federal law enforcement to identify and detain 
individuals who pose a threat to the national security of the United States. 
The PATRIOT Act also required by January 26, 2003, the development and 
certification of a technology standard, including appropriate biometric 
identifier standards, that can be used to verify the identity of persons 
applying for a U.S. visa or persons seeking to enter the United States 
pursuant to a visa for the purposes of conducting background checks, 
confirming identity, and ensuring that a person has not received a visa 
under a different name. This technology standard was to be the 
technological basis for a cross-agency, cross-platform electronic system 
that is a cost-effective, efficient, fully interoperable means to share law 
enforcement and intelligence information necessary to confirm the 
identity of persons applying for a U.S. visa or persons seeking to enter the 
United States pursuant to a visa. This electronic system was to be readily 
and easily accessible to consular officers, border inspection agents, and 
law enforcement and intelligence officers responsible for investigation or 
identification of aliens admitted to the United States pursuant to a visa. 
Every 2 years beginning on October 26, 2002, the Attorney General (now 
Secretary of Homeland Security) and the Secretary of State were to jointly 
report to Congress on the development, implementation, efficacy, and 
privacy implications of the technology standard and electronic database 
system. 

The Enhanced Border Security and Visa Entry Reform Act of 2002 required 
that, in developing the integrated entry and exit data system for the ports 
of entry under the DMIA, the Attorney General (now Secretary of 
Homeland Security) and Secretary of State implement, fund, and use the 
technology standard required by the USA PATRIOT Act at U.S. ports of 
entry and at consular posts abroad. The act also required the 
establishment of a database containing the arrival and departure data from 
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machine-readable visas, passports, and other travel and entry documents 
possessed by aliens and the interoperability of all security databases 
relevant to making determinations of admissibility under section 212 of the 
Immigration and Nationality Act. In implementing these requirements, the 
INS (now DHS) and the Department of State were to utilize technologies 
that facilitate the lawful and efficient cross-border movement of 
commerce and persons without compromising the safety and security of 
the United States and were to consider implementing a North American 
National Security Program, for which other provisions in the act called for 
a feasibility study. 

The act, as amended, also established a number of requirements regarding 
biometric travel and entry documents. It required that not later than 
October 26, 2004, the Attorney General (now Secretary of Homeland 
Security) and the Secretary of State issue to aliens only machine-readable, 
tamper-resistant visas and other travel and entry documents that use 
biometric identifiers and that they jointly establish document 
authentication standards and biometric identifiers standards to be 
employed on such visas and other travel and entry documents from among 
those biometric identifiers recognized by domestic and international 
standards organizations. It also required by October 26, 2005, the 
installation at all ports of entry of the United States equipment and 
software to allow biometric comparison and authentication of all U.S. 
visas and other travel and entry documents issued to aliens and passports 
issued by visa waiver participants. Such biometric data readers and 
scanners were to be those that domestic and international standards 
organizations determine to be highly accurate when used to verify identity, 
that can read the biometric identifiers used under the act, and that can 
authenticate the document presented to verify identity. These systems also 
were to utilize the technology standard established pursuant to the 
PATRIOT Act. 

The Intelligence Reform and Terrorism Prevention Act of 2004 did not 
amend the existing statutory provisions governing US-VISIT, but it did 
establish additional statutory requirements concerning the program. It 
described the program as an "automated biometric entry and exit data 
system" and required DHS to develop a plan to accelerate the full 
implementation of the program and to report to Congress on this plan by 
June 15, 2005. The report was to provide several types of information 
about the implementation of US- VISIT, including a "listing of ports of entry 
and other DHS and Department of State locations with biometric exit data 
systems in use." The report also was to provide a description of the 
manner in which the US-VISIT program meets the goals of a 
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comprehensive entry and exit screening system, "including both entry and 
exit biometric;" and fulfills the statutory obligations imposed on the 
program by several laws enacted between 1996 and 2002. The act provided 
that US-VISIT "shall include a requirement for the collection of biometric 
exit data for all categories of individuals who are required to provide 
biometric entry data, regardless of the port of entry where such categories 
of individuals entered the United States." 

The new provisions in the 2004 act also addressed integration and 
interoperability of databases and data systems that process or contain 
information on aliens and federal law enforcement and intelligence 
information relevant to visa issuance and admissibility of aliens; 
maintaining the accuracy and integrity of the US-VISIT data system; using 
the system to track and facilitate the processing of immigration benefits 
using biometric identifiers; the goals of the program (e.g., serving as a vital 
counterterrorism tool, screening visitors efficiently and in a welcoming 
manner, integrating relevant databases and plans for database 
modifications to address volume increase and database usage, and 
providing inspectors and related personnel with adequate real time 
information); training, education, and outreach on US-VISIT, low risk 
visitor programs, and immigration law; annual compliance reports by DHS, 
State, the Department of Justice, and any other department or agency 
subject to the requirements of the new provisions; and development and 
implementation of a registered traveler program. 
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Rank 
Order 


Name of Land POE 


Location 


State 


Total Number of US 
and Foreign Entrants 
(Pedestrians and Vehicle 
Occupants) 


1 


San Ysidro 


San Diego 


Calif. 


41 ,430,304 


2 


Calexico 


Calexico 


Calif. 


16,418,744 


3 


Otay Mesa 


Otay Mesa 


Calif. 


14,531,794 


4 


Bridge of Americas 


El Paso 


Tex. 


14,229,629 


5 


Paso del Norte 


El Paso 


Tex. 


13,443,901 


6 


Hidalgo 


Hidalgo 


Tex. 


12,788,679 


7 


Nogales DeConcini 


Nogales 


Ariz. 


12,425,006 


8 


Lincoln-Juarez Bridge 


Laredo 


Tex. 


12,328,941 


9 


Niagara Falls 3 


Niagara Falls 


N.Y. 


9,656,444 


10 


San Luis 


San Luis 


Ariz. 


9,017,655 


11 


Laredo Convent Bridge 


Laredo 


Tex. 


8,376,604 


12 


Detroit-Ambassador Bridge 


Detroit 


Mich. 


7,438,654 


13 


Douglas 


Douglas 


Ariz. 


6,795,354 


14 


Peace Bridge 


Buffalo 


N.Y. 


6,725,942 


15 


Brownsville-Gateway 


Brownsville 


Tex. 


6,712,108 


16 


Ysleta 


El Paso 


Tex. 


6,492,695 


17 


Calexico East 


Calexico 


Calif. 


6,122,111 


18 


Detroit Tunnel 


Detroit 


Mich. 


5,719,476 


19 


Port Huron 


Port Huron 


Mich. 


5,080,176 


20 


Eagle Pass Intern Bridge II 


Eagle Pass 


Tex. 


4,945,237 



Source: CBP. 

"This site comprises multiple POEs at this location. 
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According to the US- VISIT program office, US-VISIT entry capability was 




installed at the following land POE by December 31, 2005. The list is 




arranged in state alphabetical order. 


Alaska (3) 


Alcan, Alcan 


Dalton's Cache, Dalton's Cache 




Skagway, Skagway 


Arizona (8) 


Douglas, Douglas 


Lukeville, Lukeville 




Nogales DeConcini 




Nogales Mariposa 




Morley Gate, Nogales 




San Luis, San Luis 




Sasabe, Sasabe 




Naco, Naco 


California (6) 


Andrade, Andrade 


Calexico East-Imperial Valley, Calexico 




Calexico West, Calexico 




Otay Mesa, Otay Mesa 




San Ysidro, San Ysidro 




Tecate, Tecate 


Idaho (2) 


Eastport, Eastport 


Porthill, Porthill 



Maine (15) Bar Harbor Ferry, Bar Harbor 

Bridgewater, Bridgewater 
Calais-Ferry Point Bridge, Calais 
Coburn Gore, Coburn Gore 
Eastport, Eastport 
Fort Fairfield, Fort Fairfield 
Fort Kent, Fort Kent 
Hamlin, Hamlin 
Houlton, Houlton 
Jackman, Jackman 
Limestone, Limestone 
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Lubec, Lubec 
Madawaska, Madawaska 
Van Buren, Van Buren 
Vanceboro, Vanceboro 



Michigan (6) Detroit Ambassador Bridge, Detroit 

Detroit- Windsor Tunnel, Detroit 
Port Huron-Blue Water Bridge, Port Huron 
Sault Ste. Marie, Sault Ste. Marie 
Algonac Ferry, Algonac 
Marine City Ferry, Marine City 



Baudette, Baudette 
Ely, Ely 

Grand Portage, Grand Portage 
International Falls, International Falls 
Lancaster, Lancaster 
Pine Creek, Roseau 
Roseau, Roseau 
Warroad, Warroad 



Chief Mountain, Chief Mountain 
Del Bonita, Del Bonita 
Morgan, Loring 
Opheim, Opheim 
Piegan, Babb 
Raymond, Raymond 
Roosville, Roosville 
Scobey, Scobey 
Sweetgrass, Sweetgrass 
Turner, Turner 
Willow Creek, Turner 
Wild Horse, Havre 
Whitetail, Whitetail 



New Hampshire (1) Pittsburg, Pittsburg 



Minnesota (8) 



Montana (13) 
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New Mexico (3) Antelope Wells, Antelope Wells 

Columbus, Columbus 
Santa Teresa, Santa Teresa 



New York (16) Cape Vincent Ferry, Cape Vincent 

Champlain, Champlain 
Chateaugay, Chateaugay 
Fort Covington, Fort Covington 
Heart Island Ferry, Alexandria Bay 
Massena, Rooseveltown 
Mooers, Mooers 

Niagara (Lewiston-Queenston, Whirlpool, and Rainbow Bridges), Niagara 
Falls 

Niagara Falls Amtrak Station, Niagara Falls 

Ogdensburg, Ogdensburg 

Overton Corners, Champlain 

Peace Bridge, Buffalo 

Rochester Ferry, Rochester 

Rouses Point, Rouses Point 

Thousand Islands Bridge, Alexandria Bay 

Trout River, Trout River 



Ambrose, Ambrose 
Antler, Antler 
Carbury, Carbury 
Dunseith, Dunseith 
Fortuna, Fortuna 
Hannah, Hannah 
Hansboro, Hansboro 
Maida, Maida 
Neche, Neche 
Noonon, Noonan 
Northgate, Northgate 
Pembina, Pembina 
Portal, Portal 
Sarles, Sarles 
Sherwood, Sherwood 
St. John, St. John 
Walhalla, Walhalla 
Westhope, Westhope 



North Dakota (18) 
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Ohio (1) Jackson Street Pier Ferry, Akron 



Texas (25) Amistad Dam, Amistad Village 

Bridge of the Americas/Cordova Bridge, El Paso 
Brownsville-Gateway 

Brownsville-Los Tomates/Veterans International Bridge 
Brownsville-Matamoros Bridge 
Columbia Solidarity Bridge, Laredo 

Convent Street (or Gateway to the Americas International Bridge), Laredo 
Del Rio International Bridge, Del Rio 
Eagle Pass Bridge I, Eagle Pass 
Eagle Pass Bridge II, Eagle Pass 
Fabens, Fabens 

Falcon Heights, Falcon Heights 

Fort Hancock, Fort Hancock 

Gateway International Bridge, Brownsville 

Hidalgo, McAllen 

Lincoln-Juarez Bridge, Laredo 

Los Ebanos Ferry, Los Ebanos 

Los Indios, Los Indios 

Paso del Norte Bridge, El Paso 

Pharr, Pharr 

Presidio, Presidio 

Progreso, Progreso 

Rio Grande City, Rio Grande City 

Roma, Roma 

World Trade Bridge, Laredo 
Ysleta-Zaragoza Bridge, El Paso 



Alburg Springs, Alburg Springs 
Alburg, Alburg 
Beebe Plain, Beebe Plain 
Beecher Falls, Beecher Falls 
Canaan, Canaan 
Derby Line, Derby Line, 1-91 
Derby Line, Derby Line, Rte 5 
East Richford, East Richford 
Highgate Springs, Highgate Springs 
Morses Line, Morses Line 
North Troy, North Troy 
Norton, Norton 



Vermont (14) 
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Richford, Richford 
Richford/Pinnacle, Richford 
West Berkshire, West Berkshire 



Washington (13) Blaine-Pacific Highway, Blaine 

Blaine-Peace Arch, Blaine 
Boundary, Boundary 
Danville, Danville 
Ferry, Ferry 
Frontier, Frontier 
Laurier, Laurier 
Lynden, Lynden 
Metaline Falls, Metaline Falls 
Nighthawk, Nighthawk 
Oroville, Oroville 
Point Roberts, Point Roberts 
Sumas, Sumas 



Canada (1) Vancouver Amtrak Station 
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Protecting the privacy of visitors to the United States is one of the four 
stated primary mission goals of the US- VISIT program. We and others have 
raised questions in recent years about the potential privacy risks 
surrounding the use of RFID technology to track the movement of 
persons, as opposed to goods; the potential for the technology to be 
subverted for surveillance purposes, rather than identification; and the 
potential for "function creep," whereby information collected for one 
purpose gradually develops other secondary uses, such as has occurred 
with Social Security numbers. 1 In congressional testimony, we have noted 
that the use of RFID tags and associated databases raises important 
security considerations related to the confidentiality, integrity, and 
availability of the data on the tags and in the databases, and in how this 
information is being protected. 2 We have noted, as well, that while the 
federal government had begun using RFID technology for a variety of 
applications — to track and identify assets, weapons, and baggage on 
flights, for example — using this technology for generic inventory control 
did not raise the same privacy issues as using it to track the movement of 
persons. 3 

The US-VISIT Program Office has taken steps to meet statutory and 
congressional requirements protecting the privacy of individuals who 
would be affected if RFID technology were to be implemented as part of 
the US- VISIT exit and re-entry process, and to address the privacy 
concerns raised by us and others. According to OMB guidance, 4 a privacy 
impact assessment should be conducted before an agency develops or 
procures an information technology system, such as the proposed RFID 
system, which collects, maintains, or disseminates information about an 
individual — in this case, numeric information that may be linked to 
biographic information contained within databases. In January 2004, DHS 



^AO, Privacy: Key Challenges Facing Federal Agencies, GAO-06-777T (Washington, D.C.: 
May 17, 2006). See also, Electronic Frontier Foundation, letter of 4 April, 2005, to U.S. 
Department of State (http://www.eff.org/Privacy/Surveillance/RFID/RFID_passport.pdf); 
and Juels, Ari; Molnar, David; and Wagner, David, Security and Privacy Issues in E- 
passports, Cryptology ePrint Archive: Report 2005/095 (http://eprint.iacr.org/2005/095). 

2 GAO, Information Security: Key Considerations Related to Federal Implementation of 
Radio Frequency Identification Technology, GAO-05-849T (Washington, D.C.: May 22, 
2005). 

3 GAO, Information Security: Radio Frequency Identification Technology in the Federal 
Government, GAO-05-551 (Washington, D.C.: May 27, 2005). 

4 OMB M-03-22, Memorandum for Heads of Executive Departments and Agencies, OMB 
Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. 
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published a Privacy Impact Assessment in the Federal Register, as 
required by law, for the initial deployment of US- VISIT, and published the 
latest in a series of updated Privacy Impact Assessments in July 2005, 
addressing privacy issues related to the proof-of-concept testing of RFID 
for Increment 2C. 5 

In its July 2005 Privacy Impact Assessment, DHS said that by design, the 
information embedded in the RFID-readable 1-94 tag does not compromise 
a visitor's security, for the following reasons and with the following 
strictures: 

• Passive RFID minimizes privacy impacts and reduces the chance of 
visitors being surreptitiously tracked because it does not constantly 
transmit information or "beacon" a signal. 

• The numeric identifier read in the 1-94 tag does not contain and is not 
derived from any personal information, and can only be used to obtain 
personal information when combined with data within the Automated 
Identification Management System (the system created to link the 
unique RFID tag ID number to existing biographic information received 
from the TECS database). 

• The Automated Identification Management System records the exit and 
re-entry data automatically captured for a particular RFID tag, rather 
than a specific individual. The individual's complete travel history is 
created only when the information captured from the RFID tag is sent 
along with the biographic information stored in the TECS database to a 
DHS Arrival and Departure Information System. 

• The Automated Identification Management System is undergoing the 
DHS certification and accreditation process, which includes having an 
approved detailed security plan and a comprehensive technical 
assessment of the risks of operating the system. The certification and 
accreditation process will be completed before the proof-of-concept 
becomes operational. 

• The Automated Identification Management System database can only 
be accessed by authorized personnel signed into authorized 
workstations that communicate with the system via a secure network. 
These computer workstations are generally in CBP POE buildings, 
inside work areas with physical controls over who can enter the area, 
according to the Privacy Impact Assessment, and each POE is required 



5 An updated Privacy Impact Assessment was also published in September 2004 to reflect 
inclusion of Visa Waiver Program visitors in US-VISIT, expansion of US-VISIT to the 50 
busiest land POEs, and changes in the business processes used by DHS to share 
information with federal law enforcement agencies. 
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to be in compliance with DHS regulations with regard to security. Even 
if an RFID tag number were secretly detected by someone, that person 
would also have to obtain access to the Automated Identification 
Management System secure database, to link the number to an 
individual's records. 



DHS acknowledged that two potential privacy risks related to the RFID 
exit/re-entry solution have been identified, and that US-VISIT creates a 
pool of individuals whose personal information is at risk. Nevertheless, it 
is stated in the July 2005 Privacy Impact Assessment that the privacy risks 
will either be avoided or mitigated through the use of access controls, 
education and training, encryption, and minimizing collection and use of 
personal information will mitigate privacy risks associate with data 
sharing. The first stated risk is that, if the format or some other 
characteristic of the RFID tag number renders it recognizable as a US- 
VISIT RFID tag, this would allow an unauthorized reader to surreptitiously 
determine an individual's status (i.e., within US-VISIT covered population). 
DHS stated that the RFID tag number will be structured so that it cannot 
be used to identify an individual specifically as a nonimmigrant. Second, 
DHS noted there is a low risk that the RFID tag could be used to conduct 
surreptitious locational surveillance of an individual; i.e., to use the 
presence of the tag to follow an individual as he or she moves about in the 
United States. However, ensuring that RFID tag numbers do not exhibit 
properties that can be readily attributed to US- VISIT and using a limited 
radio frequency range effectively mitigates this risk, according to DHS. 
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The US-VISIT Program Office has been testing the use of passive, 
automated, radio frequency identification (RFID) technology as a means to 
record the exit of visitors from the United States at land POEs. RFID is an 
automated data-capture technology that can be used to electronically store 
information contained on a very small tag that can be embedded in a 
document (or some other physical item); in this case, US-VISIT embedded 
the tag in a modified Form 1-94, called an I-94A. This information can then 
be identified, and recorded as having been identified, by RFID readers that 
are connected to computer databases. The RFID tests were conducted for 
one-week periods at land POEs, as follows: 1 vehicular traffic was tested at 
Nogales-Mariposa and Nogales-DeConcini POEs in Nogales, Arizona; the 
Blaine-Pacific Highway and Blaine-Peace Arch POEs in Blaine, 
Washington; and Thousand Islands Bridge POE in Alexandria Bay, New 
York; pedestrian traffic was tested at the Nogales-Mariposa and Nogales- 
DeConcini POEs. 

For these exit tests, the US- VISIT Program Office developed critical 
success factor target read rates to compare them to the actual read rates 
obtained during the test for both pedestrians carrying I-94As with RFID- 
detectable tags and for travelers in vehicles who also had RFID-detectable 
I-94As with them inside the vehicles. The target exit read rates ranged 
from an expected success rate of 70 percent to 95 percent, based on 
anticipated performance under different conditions, partly as 
demonstrated in the earlier feasibility study, on business requirements, 
and on a concept of operation plan prepared for Increment 2C. 2 Table 5 
shows the exit test results compared to the target read rates, reflecting 
specifically the percentage of persons detected by the readers who were 
carrying RFID-detectable documents for (1) pedestrians and (2) persons in 
vehicles, as they passed through the POE area, while exiting the country. 



x Site selection factors included potential physical constraints, such as protected historic 
structures that could hamper installation of gantries; potential environmental impact; daily 
traffic and I-94A processing volume; speed limits; and weather conditions. 

2 A concept of operations defines how day-to-day operations are (or will be) carried out to 
meet mission needs. The concept of operations includes high-level descriptions of 
information systems, their interrelationships, and information flows. It also describes the 
operations that must be performed, who must perform them, and where and how the 
operations will be carried out. 
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Table 5: RFID Read Rate Test Results for Persons in Vehicles and Pedestrians 
Exiting the Country with RFID-Readable Documents 


Type of test Location of test 


Critical Success 
Factor Target 
Rate (%) 


Actual Read 
Rate (%) 


Sample Size 
(vehicles or 
pedestrians) 


Pedestrian Exit Nogales-Mariposa 


95 


67 


3 a 


Vehicle Exit Blaine-Pacific 
Highway 


70 


14 


166 


Thousand Islands 
Bridge at 
Alexandria Bay 


70 


4 


50 



Source: US-VISIT Program Office 

"Because of the small number of pedestrians carrying RFID readable documents in the test, any 
findings should be interpreted with caution. 



In phase 1 of proof -of-concept testing for RFID, US-VISIT reported that 
read rates were higher for both vehicle occupants and pedestrians who 
held the I-94A up toward the reader, rather than leaving it inside a pocket. 
Through the use of billboards, radio and print advertisements, and other 
methods of communication, visitors were encouraged to place their RFID- 
detectable I-94A forms on the vehicle dashboard or up to a window. These 
locations were believed to increase the chances for a successful read. 
Those who took these actions were referred to as "participants," and those 
who did not as "nonparticipants." The US-VISIT Program Office reported 
that during the week-long proof-of-concept exit testing, one of the three 
pedestrians was a participant — that is, the individual was observed as 
voluntarily complying with the instructions; for those exiting in a vehicle, 
these data were not reported. Moreover, although CBP officials made 
substantial pre-test efforts to encourage travelers to optimize the chances 
of I-94A tags being read, the report noted that this effort apparently met 
with mixed success and that no additional solutions were planned. 

During the time period that US- VISIT tested the performance of RFID 
readers for detecting I-94As carried by persons exiting the country in 
vehicles at two land POEs (Thousand Islands Bridge, Alexandria Bay, New 
York and Blaine-Pacific Highway, Washington), it also tested RFID reader 
performance for persons in vehicles with RFID-embedded I-94As who re- 
entered the country at both of these locations and three others (Blaine- 
Peace Arch, Washington; and, in Arizona, Nogales-Mariposa and Nogales- 
DeConcini). In addition, tests of RFID detectability carried by pedestrians 
re-entering the country were conducted at Nogales-Mariposa, and Nogales- 
DeConcini; pedestrian exit was tested only at Nogales-Mariposa because 
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of operational constraints at Nogales-DeConcini, according to the report 
on the tests. Since persons re-entering the country with a RFID-enabled I- 
94 would already have obtained an I-94A on a prior visit to the United 
States, in order for it to be detected by an RFID reader, this process is 
sometimes referred to by the US-VISIT program office as "re-entry." 

DHS set separate, higher critical success factors (performance targets) for 
the RFID proof-of-concept tests for the vehicle re-entry process than for 
the vehicle exit process. According to a US-VISIT official, these higher 
performance targets were based, in part, on the fact that vehicles must 
stop as part of the re-entry process, which makes it more likely that a tag 
will be detected than is the case for exiting vehicles, which do not need to 
slow down or stop at land POEs. 3 As with the tests conducted for exit, test 
observers monitored traveler behavior to see whether, in compliance with 
numerous advertisements in print and on local radio, the vehicle driver 
placed the RFID-enabled I-94A on the vehicle dashboard or on an empty 
passenger seat, or, for vehicle occupants, if they held the I-94A up to a 
window or who made it otherwise visible, to better enable detection it by 
the reader. Vehicle drivers or occupants who displayed an I-94A in any of 
these requested ways were categorized as "participants," but read rates for 
them were, nevertheless, low at four of five test locations. For example, at 
Nogales-DeConcini, which had the lowest vehicle-entry read rates overall, 
the read rate was 27 percent for the 62 persons re-entering in vehicles with 
visitors whom US -VISIT reported as making an effort to have their I-94A 
tags read. In contrast, at Nogales-Mariposa, which had the highest overall 
re-entry read rate for the vehicle test, US- VISIT reported that 83 out of 96 
(86 percent) of travelers who were categorized as participants were 
detected. Among those at this same location who did not make this effort, 
US- VISIT reported that I-94s with RFID tags were detected for about half 
(51 percent) of the persons in the vehicles. Table 6 shows the results of 
RFID read-rates upon re-entry for vehicle participants and 
nonparticipants. 



3 According to a program official involved in setting the target rates, the read rates expected 
for vehicles entering the country were also expected to be lower than for pedestrians 
because of potential interference from metal in vehicles. 



Page 86 



GAO-07-248 US-VISIT at Land Ports of Entry 



Appendix VII: US-VISIT Test of Radio 
Frequency Identification (RFID) Readers 
Upon Exit and Re-entry at Selected Land 
POEs 



Table 6: RFID Test Read Rates for Persons Re-Entering the Country in Vehicles at Locations Where US-VISIT Tested RFID 
Technology 



Type of test 


Target read 
rate (%) 


Nogales- 
Mariposa: 
Percent and 
Number 


Nogales- 
DeConcini: 
Percent and 
Number 


Blaine-Pacific 
Highway: 
Percent and 
Number 


Blaine-Peace 
Arch: 
Percent and 
Number 


Thousand 
Islands Bridge: 
Percent and 
Number 


Vehicle entry 


80 


P: 86% (83/96) 


P: 27% 
(17/62) 


P: 45% (13/29) 


P: 55% (18/33) 


P: 33% (3/9) 






N: 51% (101/199) 


N: 11% 
(25/236) 


N: 14% (15/110) 


N: 19% (14/72) 


N: 67% (2/3) 






C: 62% (184/295) 


C: 14% 


C: 20% (28/139) 


C: 30% (32/105) 


C: 42% (5/12) 



(425/298) 



Source: US-VISIT Program Office 

P: Participants: those vehicle drivers who placed the I-94A form either on the dashboard, or on an 
empty seat; vehicle occupants who held the I-94A up to a window or who placed it on the dashboard 
or who made it otherwise visible. 

N: Non-participants: Vehicle drivers and occupants who did not appear to comply with any of the 
specified modes of making the I-94A visible. 

C: Combined read rate for participants and nonparticipants. 

Table 7 shows the results of RFID read-rate detection upon re-entry for 
pedestrian participants and nonparticipants. 



Table 7: RFID Test Read Rates for Pedestrians Re-entering the Country at Locations Where US-VISIT Tested RFID Technology 







Nogales- 


Nogales- 


Blaine-Pacific 


Blaine-Peace 


Thousand 






Mariposa: 


DeConcini: 


Highway: 


Arch: 


Islands Bridge: 




Target read rate 


Percent and 


Percent and 


Percent and 


Percent and 


Percent and 


Type of test 


(percent) 


Number 9 


Number 8 


Number 


Number 


Number 


Pedestrian entry 


95 


P: 100% 


P: 84% (32/38) 


No data 


No data 


No data 



(1 out of 1) 

N: 50% N: 68% 

(6/12) (179/264) 
C: 54% (7/1 3) C: 70% 

(211/302) 

Source: US-VISIT Program Office 

"Because of the small number of pedestrians that participated in the test, any findings should be 
interpreted with caution. 
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Note: 

P is participants; defined as those pedestrians who held the I-94A form so that it was out and visible 
upon entering the processing area. 

N is non-participants; defined as those pedestrians who did not hold the I-94A form in such as a way 
that it was visible. 

C: Combined read rate for participants and nonparticipants 
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U.S. Department of Homeland Security 

Washington, DC 20528 




Homeland 
Security 



October 3 1,2006 



Mr. Richard M. Stana 
Director 

Homeland Security and Justice Issues 
U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Dear Mr. Stana: 

RE: Draft Report GAO-07-56, Border Security: US-VISIT Program Faces Strategic, 
Operational, and Technological Challenges at Land Ports of Entry 
(GAO Job Code 440427) 

Department of Homeland Security (DHS) officials appreciate the opportunity to review and 
comment on the draft report referenced above. The Government Accountability Office (GAO) 
makes two recommendations with which we generally agree. While we largely agree with GAO 
on many of the findings, there are some findings with which we disagree. Our attachment 
includes some clarifications and other comments that we consider more than technical. 

We appreciate the time GAO has taken to review the United States Visitor and Immigrant Status 
Indicator Technology (US-VISIT) Program's ability to collect, maintain, and share data on 
selected foreign nationals entering and exiting the United States at air, sea, and land ports of 
entry (POEs). US-VISIT represents the greatest advancement in border technology in three 
decades. DHS established US-VISIT to enhance the safety of our citizens and visitors, facilitate 
legitimate travel and trade, enhance the integrity of our immigration system, and protect the 
privacy of travelers to the United States. In the three years since its inception, US-VISIT has 
processed over 70 million visitors at ports of entry, linking together systems from DHS and the 
Departments of State and Justice. In FY 2005, US-VISIT was successfully deployed at 154 land 
border ports of entry, with the majority of ports reporting improved process times. Even with 
US- VISIT'S increased security checks, travelers have not been significantly inconvenienced. In 
fact, wait times for Form 1-94 (Arrival-Departure Form) issuance at land border ports of entry 
have gone down, and surveys from travelers show that the vast majority do not object to US- 
VISIT's biometric procedures. 

For all the successes of US-VISIT, Department officials agree that we need to improve existing 
management controls associated with US-VISIT, develop performance measures to assess the 
impact of US-VISIT operations at land POEs, and ensure that the statutorily mandated report 
mentioned in the draft report describes how DHS will move to a biometric entry/exit capability 
and align US-VISIT with emerging land border security initiatives. DHS officials have already 
established a great deal of the foundation for meeting future challenges. 



www.dhs.gov 
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Customs and Border Protection (CBP) officials will support US- VISIT program officials as they 
implement the first recommendation. In addition, CBP personnel have resolved the computer 
problems noted in the draft report, implemented preliminary monitoring of the system, and have 
established a working group to determine how to implement detailed monitoring of all 
applications including US Arrival and US Pedestrian at land border ports of entry. 

Comments associated with our "sensitivity review" will be provided under separate cover. 

Sincerely, 

Steven J. Pecinovsky 
Director 

Departmental GAO/OIG Liaison Office 



Attachment 
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DHS/US- VISIT Clarifications and Other Comments Associated with GAO's Draft Report 
Findings/Observations 

1. GAO Highlights page, second paragraph: "An interim non-biometric exit technology being 
tested does not meet the statutory requirement for a congressionally mandated biometric exit 
capability and cannot ensure that visitors who enter the country are those who leave." DHS/US- 
VISIT clarification: The interim solution (Passive RF embedded 1-94) was used because 
industry was not to the point of developing a biometric exit device that could satisfy mission 
requirements such as not impacting traffic flow and not having safety impacts. This position is 
also reflected in operational alternatives documentation. Subsequent research and industry 
outreach will be performed so that DHS/US-VISIT officials can satisfy the biometric exit 
mandate. 

2. Page 5, Results in Brief: GAO infers that US- VISIT has not adequately evaluated the impact 
of the 2- to 10-print digital scanning effort. US- VISIT response: US-VISIT officials have 
recognized that this transition has a high likelihood of impacting port facilities and US-VISIT 
personnel have taken significant steps to work with industry to speed up processing time and to 
miniaturize the current 10-print capture devices in an attempt to eliminate and/or significantly 
reduce the impact of deploying 10-print scanning. 

3. Page 6: US-VISIT comment: The language implies that US-VISIT personnel did not fully 
consider the impact [of US- VISIT] on the overall operations at the land POEs. According to US- 
VISIT officials, the US-VISIT touch point in land border operations is in fact limited to changes 
in 1-94 processing time; the other factors related to port secondary capacity, staffing and traveler 
throughput are constant regardless of whether US-VISIT had been implemented. For example, 
the lack of available port secondary parking due to CBP processing of increased numbers of 
applicants for admission is not a symptom of US-VISIT, (in fact in many cases US-VISIT 
decreased the processing time for 1-94 issuance), but is indicative of an increase in traffic and/or 
policy changes as to what traveler population requires secondary processing. These factors are 
arguably beyond the scope of US-VISIT and are more appropriately addressed through a larger 
evaluation as to whether or not current port facilities and staff are adequate to meet mission 
requirements. It should also be noted that the 1-94 process is one of many steps, each of which 
may impact overall wait times. A similar discussion appears on page 32. 

4. Page 14: US-VISIT clarification/comment: The statutory mandates regarding biometric 
screening only applies to aliens and not U.S. citizens. On pages 14 and 15, in the text preamble 
to the pie charts [on page 16], GAO states that most land border crossers are, by regulation, 
exempt from US- VISIT screening and U.S. citizens are included in this group. Regulations flow 
from statutory language and US-VISIT currently has no statutory mandate to screen U.S. 
citizens. GAO should re-draft any chart (and explanatory text) that includes U.S. citizens as part 
of the calculation of percentage of persons screened by US-VISIT. 

5. Page 16: US-VISIT comment: Crossing statistics appear misleading in the report. For 
example, where GAO offers its first set of pie charts on the number of persons processed via US- 
VISIT, the charts have included U.S. citizens in the total numbers. This offers the uninformed 
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reader misleading percentage data regarding the sets of people US-VISIT is authorized to screen 
biometrically at the land ports of entry. 

6. Page 26: U.S. VISIT comment: The report presents conflicting positions on the benefits 
realized from US-VISIT deployments. In several locations the narrative notes that the 
capabilities provided by US-VISIT are recognized as providing efficiencies to the 1-94 process 
(as supported by US-VISIT performance evaluations). In other sections (e.g., page 26) there are 
statements that the capabilities have added to the time required to process visitors. It is implied 
the additional time resulted in turning visitors away at the border. US-VISIT officials believe 
that the capabilities deployed have reduced the time required to process an 1-94, and officials 
have validated this position with performance evaluations. Statements of increased time, based 
on the inclusion of factors outside of the 1-94 issuance process, are not an accurate analysis of the 
operations at the POE. The concerns listed by the San Ysidro offices are indicative of staffing 
and facilities capacity factors, that were likely due to fully implementing national policy 
guidelines as to which traveler populations require secondary processing. These guidelines were 
not changed as a result of the implementation of US- VISIT. 

7. Page 50: "US-VISIT reported that while the placement of the portal readers will not be 
changed, it is taking steps to improve the likelihood of detection with additional antennae, 
readers, and signage. However, there are no plans at present to modify the existing POE 
infrastructure..." US- VISIT comment: A new pedestrian walkway was constructed parallel to 
the existing pedestrian entry. Signage, sidewalks and a new secure roto-gate were installed to 
serve as the primary pedestrian exit walkway. 

8. Page 53: "According to the US- VISIT Chief Strategist, the Program Office drafted in March 
2005 a strategic plan that showed how US- VISIT would be strategically aligned with DHS's 
organizational mission and also defined an overall vision for immigration and border 
management." GAO then has a footnote (number 59) saying, "This plan is distinct from the 
legislatively mandated plan that is to describe a comprehensive US-VISIT entry/exit screening 
system." US- VISIT comments: There is just one plan - not two. The GAO language implies 
that there is more than one plan. US-VISIT began working on a strategic plan in late 2004 and 
finished it in March 2005. The Intel Reform Act of 2004, in section 7208(c), called for DHS to 
submit a plan to Congress on the current functionality of the entry/exit system, as well as a plan 
for how the Secretary intends to expedite full deployment. As part of the US-VISIT response to 
this report requirement, US-VISIT officials included the Executive Summary of the Strategic 
Plan to explain how entry/exit works across the entire border and immigration enterprise. 
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